Senior Staff AI SOC Engineer - Remote

Cribl; Oklahoma City (OK); Remote; USD 230,000 - 280,000; Full time

Benefits offered by this job

Health, dental, and vision insurance

Short-term disability insurance

Life insurance

Paid holidays and paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is seeking a Senior Staff Software Engineer to join the Security Products team, focusing on building next‑generation AI SOC capabilities. You will architect autonomous reasoning, multi‑agent investigation frameworks, and contextual enrichment layers for post‑detection workflows.

This fully remote role offers the chance to lead design reviews, collaborate with product managers and researchers, and deliver scalable, low‑latency systems that help security operations run at machine speed.

Qualifications

• Bachelor's degree in Computer Science, Electrical Engineering, or equivalent experience (Master's preferred).
• 12+ years of experience building scale production software.
• Experience leading engineering initiatives and building AI SOC, SOAR, or post-detection automation capabilities at scale.
• Deep, practical experience building and deploying production‑grade AI systems—LLM orchestration, embeddings, vector databases, dynamic tool calling, and RAG architectures in enterprise software.
• Track record of designing and operating scalable, low-latency distributed systems for asynchronous event processing and multi‑system workflow state machines.
• Deep understanding of the security analyst workflow and MITRE ATT&CK.
• Strong experience designing robust, extensible API frameworks to interface with third‑party security platforms (EDR, Identity Providers, Cloud Infrastructure, SIEM/SOAR).
• Proven capability to lead ambiguous, highly autonomous initiatives from concept to production.
• High ownership mindset with bias toward quality, performance, and simplicity.
• Clear, effective communicator able to explain complex technical ideas to engineers, partners, and customers in remote teams.
• Direct experience building autonomous agent frameworks for security context.
• Experience with JavaScript/TypeScript, NodeJS, or Go/Python in enterprise systems.
• Background in graph databases or contextual graph models used to represent identities, endpoints, and threat histories.
• Active open‑source contributions in AI, agentic automation, or security space.

Responsibilities

• Architect post‑detection workflows including autonomous triage and investigation.
• Build production‑grade reasoning systems using LLMs, embeddings, and context graphs to formulate hypotheses, gather evidence, and deliver explainable verdicts.
• Work closely with Cribl Detect to ingest high‑fidelity detection signals and trigger automated investigations and responses.
• Explore agentic paradigms, multi‑agent frameworks, and natural language SOC interfaces with rapid prototypes.
• Write core abstractions, design agent communication protocols, review critical code, and establish benchmarks for model accuracy, latency, and reliability.
• Build safe execution frameworks offering transparent reasoning trails and human‑in‑the‑loop controls.
• Partner with product managers, security researchers, and stakeholders to translate ambiguous ideas into technical strategies and executable plans.
• Guide engineering talent and represent Cribl's AI SOC vision via architecture reviews, technical blogs, and discussions.
• This position will require stand‑by, on‑call, or off‑hours duties.

Skills

LLM orchestration

Agent frameworks

Go

Python

JavaScript/TypeScript

NodeJS

Graph databases

Distributed systems

MITRE ATT&CK

Education

Bachelor's degree in Computer Science or Electrical Engineering

Master's degree preferred

Tools

NodeJS

Go

Python

JavaScript/TypeScript

Vector databases

RAG architectures

APIs integration

Job description

Cribl is seeking a Senior Staff Software Engineer to join the Security Products team, focusing on building next‑generation AI SOC capabilities. You will architect autonomous reasoning, multi‑agent investigation frameworks, and contextual enrichment layers for post‑detection workflows.

This fully remote role offers the chance to lead design reviews, collaborate with product managers and researchers, and deliver scalable, low‑latency systems that help security operations run at machine speed.