Senior Cribl Engineer / Security Data Engineer

TSG Risk Management; Charlotte (NC); Hybrid; USD 120,000 - 160,000; Full time

Job summary

TSG Risk Management in Charlotte, NC seeks a Senior Cribl Engineer / Security Data Engineer to build and optimize scalable data pipelines using Cribl LogStream. You will design and maintain Snowflake-based data architectures and integrate with AWS, SIEM, and security analytics tools.

The role requires hands-on experience with Cribl, Snowflake, and Databricks, plus scripting in Python/JavaScript. Hybrid or remote work options are available, with a strong focus on data security and operational

Qualifications

• 3+ years Cribl LogStream administration, configuration and pipeline development.
• 2+ years Snowflake administration, architecture and data engineering at scale.
• Experience designing large-scale security data ingestion and processing with Snowflake/Databricks.
• Scripting in Python or JavaScript for pipeline automation.
• Experience onboarding security data within SIEM or security analytics environments.
• Familiarity with OCSF and security telemetry best practices.
• Strong problem-solving, debugging, and analytical skills.
• Experience with Snowflake Cortex, Snowpark and advanced automation.

Responsibilities

• Develop, implement, and maintain data pipelines in Cribl LogStream.
• Configure routing, transformation, enrichment, and data quality processes.
• Integrate Cribl with AWS, SIEM platforms, and security analytics tools.
• Build and optimize automated data ingestion and onboarding workflows.
• Onboard security telemetry for SIEM, threat hunting, and incident response.
• Collaborate with Security Ops, Data Eng, Infra and Analytics teams.
• Monitor pipeline performance and implement continuous improvements.
• Document configurations and data flows.
• Maintain Snowflake databases, schemas, tables, views, streams, and data sharing.

Skills

Cribl LogStream

Snowflake

Databricks

Python

JavaScript

SIEM

OCSF

Data pipelines

Tools

Snowflake Cortex

Snowpark

Python UDFs

Job description

Senior Cribl Engineer / Security Data Engineer
Location: Charlotte, NC preferred. Candidates in New York City, Los Angeles, Southern California, or other locations may also be considered.

Work Model: Flexible hybrid or remote

Position Overview

Seeking an experienced Senior Cribl Engineer / Security Data Engineer to develop, maintain, and optimize scalable data pipelines utilizing Cribl LogStream. The ideal candidate should have deep knowledge of Cribl architecture, extensive hands‑on experience in data engineering, and the ability to improve data ingestion and processing workflows. Familiarity with security operations, SIEM platforms, the Open Cybersecurity Schema Framework (OCSF), security log data, AWS cloud services, and modern data platforms such as Snowflake and Databricks is highly desirable.

Responsibilities

• Develop, implement, and maintain data processing pipelines within Cribl LogStream.
• Configure and optimize data routing, transformation, enrichment, filtering, normalization, and data quality processes.
• Develop and support integrations between Cribl, AWS, SIEM platforms, security analytics tools, and enterprise security lake data platforms.
• Build, troubleshoot, and optimize automated data ingestion and onboarding workflows.
• Onboard and validate security telemetry for SIEM, detection engineering, threat hunting, incident response, and security analytics use cases.
• Collaborate with Security Operations, Detection Engineering, Data Engineering, Infrastructure, and Analytics teams to deliver reliable, scalable, and high‑quality data solutions.
• Monitor pipeline performance, resolve issues, and implement continuous improvements.
• Document pipeline configurations, operational procedures, and data flows.
• Develop, create, and maintain Snowflake database objects including databases, schemas, tables, views, streams, tasks, stored procedures, and secure data‑sharing configurations.

Qualifications

• 3+ years of experience with Cribl LogStream administration, configuration, and pipeline development.
• 2+ years of hands‑on experience with Snowflake administration, architecture, and data engineering in large‑scale enterprise environments.
• Experience designing and supporting large‑scale security data ingestion, transformation, and processing pipelines utilizing platforms such as Snowflake and Databricks.
• Experience with scripting languages (e.g., Python, JavaScript) for pipeline automation.
• Experience onboarding and managing enterprise security data within SIEM, security data lake, or security analytics environments.
• Familiarity with OCSF, security data normalization, governance, compliance, and other security telemetry best practices.
• Excellent problem‑solving skills, ability to debug complex pipeline issues, and strong analytical thinking
• Experience designing, creating, and managing Snowflake databases, schemas, tables, views, streams, tasks, stored procedures, and data pipelines
• Experience with Snowflake Cortex, Snowpark, Python UDFs, stored procedures, and advanced automation frameworks.