Remote Senior Threat Detection Engineer: Detection as Code

Cribl; Richmond (VA); Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is seeking a senior security engineer to join Team Alpine to own detection engineering, threat hunting, and incident response in a modern SIEM with GitOps. You will build detections in code and map them to MITRE ATT&CK while reducing alert noise and scaling to enterprise telemetry.

You will collaborate with IT, Product Security, and Legal to close visibility gaps, mentor teammates, and help shape security operations in a remote-first, fast-growing company.

Qualifications

• 5+ years in security operations, with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry.
• Take part in the incident response rotation from first alert to closure.
• Assist in ownership of security log health and data pipelines with Cribl Stream.
• Mentor teammates through code review, pairing, and clear documentation.

Skills

Python

KQL

Git workflows

Threat hunting

Incident response

SIEM

Tools

Cribl Stream

GitHub Actions

Sigma rules

Atomic Red Team

Job description

Cribl is seeking a senior security engineer to join Team Alpine to own detection engineering, threat hunting, and incident response in a modern SIEM with GitOps. You will build detections in code and map them to MITRE ATT&CK while reducing alert noise and scaling to enterprise telemetry.

You will collaborate with IT, Product Security, and Legal to close visibility gaps, mentor teammates, and help shape security operations in a remote-first, fast-growing company.