Senior Cribl Pipeline Engineer / Security Data Engineer

TSG Risk Management; Charlotte (NC); Hybrid; USD 120,000 - 180,000; Full time

Job summary

TSG Risk Management is seeking a Senior Cribl Pipeline Engineer / Security Data Engineer in Charlotte (NC) or nearby locations. The role emphasizes hands-on Cribl development to build, optimize, and maintain scalable data pipelines that feed SIEMs, data lakes, and analytics platforms.

You will map security telemetry, implement field extractions, and collaborate with Security Operations, Data Engineering, and Analytics teams to deliver reliable, high-quality data flows across Snowflake,

Qualifications

• 3+ years hands-on Cribl LogStream/Stream development experience.
• Experience mapping data and building scalable enterprise data pipelines.
• Experience onboarding data into SIEMs, data lakes, or analytics platforms.
• Strong scripting skills in Python or JavaScript.
• Snowflake administration and data-architecture experience.

Responsibilities

• Develop, implement, and maintain enterprise data-processing pipelines using Cribl LogStream/Stream.
• Build and maintain Cribl pipelines, packs, routes, functions, parsers, and reusable content.
• Perform field extraction, parsing, filtering, masking, enrichment, normalization, and transformation.
• Map security telemetry to OCSF or other standardized data schemas.
• Build and support integrations between Cribl, Snowflake, Databricks, AWS, SIEM platforms, and data lakes.
• Onboard and validate new data sources across endpoint, firewall, identity, cloud, and network telemetry.
• Validate transformed events contain required fields for SIEM, threat-hunting, and analytics teams.
• Troubleshoot pipeline issues and monitor performance; optimize data volumes.
• Document configurations, mappings, and end-to-end data flows.

Skills

Cribl LogStream/Stream development

Field extraction and parsing

Data pipeline design

Snowflake administration

Python / JavaScript scripting

Data mapping to OCSF

Troubleshooting pipelines

Cross-team collaboration

Tools

Snowflake

Databricks

AWS

Splunk

Cribl content packs

Job description

Senior Cribl Pipeline Engineer / Security Data Engineer

Location: Charlotte, NC preferred. Candidates in New York City, Los Angeles, Southern California, or other locations may also be considered.

Work Model: Flexible hybrid or remote

Position Overview

We are seeking an experienced Senior Cribl Pipeline Engineer / Security Data Engineer to build, maintain, and optimize scalable data pipelines using Cribl LogStream/Stream.

This is a hands-on Cribl development role focused on using pipelines, packs, routes, functions, parsers, and field-level transformations to process and deliver enterprise data. The position is not primarily focused on backend infrastructure administration or simply monitoring whether data is flowing through the platform.

The ideal candidate will have substantial experience extracting and mapping fields, parsing and normalizing data, building reusable Cribl content, and routing information into Snowflake, Databricks, SIEM platforms, security analytics tools, or enterprise data lakes.

Experience working with security telemetry, OCSF mapping, Snowflake engineering, Splunk, AWS, and enterprise-scale data environments is strongly preferred. Candidates with strong Cribl experience from Splunk, observability, or infrastructure environments may also be considered if they have significant hands-on pipeline development experience.

Responsibilities

• Develop, implement, and maintain enterprise data-processing pipelines using Cribl LogStream/Stream.
• Build and maintain Cribl pipelines, packs, routes, functions, parsers, and reusable content.
• Perform field extraction, parsing, filtering, masking, enrichment, normalization, and transformation.
• Map security telemetry to OCSF or other standardized data schemas.
• Build and support integrations between Cribl, Snowflake, Databricks, AWS, SIEM platforms, security tools, observability platforms, and enterprise data lakes.
• Onboard and validate new data sources, including endpoint, firewall, identity, cloud, audit, application, infrastructure, and network telemetry.
• Validate that transformed events contain the fields required by SIEM, detection engineering, threat-hunting, incident-response, and security-analytics teams.
• Troubleshoot pipeline logic, malformed events, parsing failures, schema drift, field-mapping problems, dropped data, and data-quality issues.
• Monitor pipeline performance and optimize routing, transformations, and data volumes.
• Develop and support automated ingestion and source-onboarding workflows.
• Create and maintain Snowflake databases, schemas, tables, views, streams, tasks, stored procedures, and data pipelines.
• Collaborate with Security Operations, Detection Engineering, Data Engineering, Infrastructure, Analytics, and platform teams.
• Document pipeline configurations, source-to-target mappings, operational procedures, and end-to-end data flows.

Required Qualifications

• At least 3 years of substantial hands-on experience using Cribl LogStream/Stream to develop and maintain pipelines, packs, routes, functions, parsers, and field-level transformations.
• Demonstrated experience with Cribl field extraction, parsing, enrichment, filtering, normalization, transformation, and routing.
• Ability to clearly explain an end-to-end data flow, including the original source, processing performed in Cribl, and the downstream destination.
• Experience building and supporting large-scale enterprise data-ingestion and processing pipelines.
• Experience onboarding data into SIEM, security data lake, observability, analytics, or similar enterprise platforms.
• Experience troubleshooting pipeline failures, malformed events, missing fields, schema changes, performance problems, and data-quality issues.
• Experience with Python, JavaScript, or a similar scripting language for pipeline automation.
• At least 2 years of hands-on Snowflake administration, architecture, or data-engineering experience in a large enterprise environment.
• Experience designing or maintaining Snowflake databases, schemas, tables, views, streams, tasks, stored procedures, or ingestion pipelines.
• Strong problem-solving, debugging, documentation, and communication skills.
• Ability to work effectively with technical teams across security, data, infrastructure, operations, and analytics.

Preferred Qualifications

• Experience mapping security data to OCSF.
• Experience developing and maintaining custom Cribl packs.
• Experience with security telemetry, security data normalization, or security analytics.
• Experience with Splunk, including Splunk Enterprise or Splunk Enterprise Security.
• Experience with SIEM architecture, SIEM migrations, or security-data onboarding.
• Experience with endpoint, firewall, network, identity, cloud, application, infrastructure, vulnerability, or audit logs.
• Experience with detection engineering, threat hunting, incident response, or Security Operations.
• Experience with AWS security and data services.
• Experience with Databricks, Delta Lake, or enterprise security data lakes.
• Experience with Snowpark, Snowflake Cortex, Python UDFs, secure data sharing, or advanced Snowflake automation.
• Experience with data governance, compliance, schema management, and data-quality controls.

Important Role Distinction

This position requires someone who has actively used Cribl to build and manipulate data flows.

Experience focused mainly on platform health, backend infrastructure, memory, system administration, observability monitoring, or confirming that data is flowing will not be sufficient without demonstrated hands-on experience developing Cribl pipelines, packs, field extractions, and transformations.