Remote Senior Threat Detection Engineer - Detection as Code

Cribl; Madison (WI); Remote; USD 150,000 - 185,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is seeking a hands-on senior security engineer to join Team Alpine, protecting Cribl's telemetry platform and detecting threats through detections as code. You will design, build, and tune KQL-based detections in a GitOps workflow, align coverage with MITRE ATT&CK, and reduce alert fatigue.

You will lead incident response rotations, mentor teammates, and collaborate with Product Security, IT, and Legal, while maintaining log pipelines and Cribl Stream integrations to keep detections

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries and practical MITRE ATT&CK knowledge.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow: issue, PR, unit/back-testing, auto deployment.
• Map detections to MITRE ATT&CK, identify coverage gaps, prioritize investments per threat model.
• Lead threat hunting across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry.

Skills

Python

KQL

Git workflow

Threat hunting

Incident response

SIEM

Detections as code

Tools

Cribl Stream

Sigma rules

MITRE ATT&CK

CI/CD

Job description

Cribl is seeking a hands-on senior security engineer to join Team Alpine, protecting Cribl's telemetry platform and detecting threats through detections as code. You will design, build, and tune KQL-based detections in a GitOps workflow, align coverage with MITRE ATT&CK, and reduce alert fatigue.

You will lead incident response rotations, mentor teammates, and collaborate with Product Security, IT, and Legal, while maintaining log pipelines and Cribl Stream integrations to keep detections