Senior Threat Detection Engineer — AI-Driven Detections & IR Lead

Cribl; United States; In loco; USD 108.000 - 169.000; Tempo pieno

Vantaggi offerti da questo lavoro

Health (medical) benefits

Dental benefits

Vision benefits

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Descrizione del lavoro

Cribl is a leading provider of telemetry infrastructure, building the AI era’s observability platform. We’re seeking a senior security engineer to own the detection lifecycle, hunt threats, and drive incident response for Cribl’s security program. You will work closely with Product Security, IT, and Legal, reporting to the Sr.

Director, Security Engineering and Operations. You’ll lead investigations, develop durable detections, and improve log pipelines and data health across Cribl Stream

Competenze

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis, not just labeling.
• Experience investigating incidents in cloud, SaaS, and identity providers.
• Hands-on experience with log pipelines: getting data in, parsing it, and fixing it when it breaks.

Mansioni

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow, including automated deployment.
• Map detections to MITRE ATT&CK, identify gaps, and guide investments based on threat model.
• Review community and vendor rule releases and decide what to adopt or adapt.
• Cut alert noise by tuning rules and tracking detection quality metrics.

Conoscenze

Python

KQL

Git workflows

Threat hunting

Incident response

Detections as code

Detection engineering

Communication

Formazione

Bachelor's degree in CS or related

Strumenti

Cribl Stream

Sigma rules

Atomic Red Team

Caldera

CI/CD

SIEM

Descrizione del lavoro

Cribl is a leading provider of telemetry infrastructure, building the AI era’s observability platform. We’re seeking a senior security engineer to own the detection lifecycle, hunt threats, and drive incident response for Cribl’s security program. You will work closely with Product Security, IT, and Legal, reporting to the Sr.

Director, Security Engineering and Operations. You’ll lead investigations, develop durable detections, and improve log pipelines and data health across Cribl Stream