Remote Senior Threat Detection Engineer — Detections & IR

VulnU; United States; Remote; USD 108,000 - 169,000; Full time

Benefits offered by this job

Health insurance

401(k) and equity

Paid time off

Remote work

Job summary

Cribl is seeking an experienced security professional to own detection engineering, threat hunting, and incident response as part of an internal security team. You will design detections in code, map to MITRE ATT&CK, and drive improvements across log pipelines and SIEM integrations.

You’ll lead investigations during an initial IR rotation, collaborate with Product Security, IT, and Legal, and help ensure healthy telemetry pipelines.

Qualifications

• 5+ years in security operations, with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis.
• Hands-on experience with log pipelines: getting data in, parsing it, and fixing it when it breaks.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow, including testing and automated deployment.
• Map detections to MITRE ATT&CK and analyze coverage gaps.
• Review community and vendor rule releases to decide adoption or adaptation.
• Cut alert noise by tuning/retiring rules and tracking quality metrics.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate telemetry.
• Turn hunt findings into durable detections, documentation, and backlog items.
• Participate in incident response rotation, triage, scope, contain, and investigate incidents.

Skills

Threat hunting

Detection engineering

Incident response

Python

KQL

Git-based workflows

Tools

Sigma rules

Cribl Stream

GitHub Actions

CI/CD

SIEM

Adversary emulation tools

Job description

Cribl is seeking an experienced security professional to own detection engineering, threat hunting, and incident response as part of an internal security team. You will design detections in code, map to MITRE ATT&CK, and drive improvements across log pipelines and SIEM integrations.

You’ll lead investigations during an initial IR rotation, collaborate with Product Security, IT, and Legal, and help ensure healthy telemetry pipelines.