Senior Threat Detection Engineer: Detection as Code

Cribl; Annapolis (MD); Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

401(k)

Equity

Job summary

Cribl is seeking a senior security leader to own detection engineering, threat hunting, and incident response. You will design detections as code, map to MITRE ATT&CK, and improve log pipelines across cloud and on-prem environments.

You’ll collaborate with IT, Legal, and Product Security to reduce risk and accelerate detection coverage. The role is remote-first in the US, offering opportunities to shape the security program, mentor teammates, and influence the security roadmap while aligning

Qualifications

• 5+ years in security operations, with significant hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis, not just labeling.
• Experience investigating incidents in cloud (AWS, GCP, and/or Azure), SaaS, and identity providers.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow: PRs, unit tests, automated deployment.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, and endpoints.
• Lead IR rotation and drive lessons into new detections and playbooks.
• Maintain health of security log flow and data pipelines with Cribl Stream.
• Build and maintain CI/CD behind the detection program, including GitHub Actions and SIEM integrations.

Skills

Python

KQL

Git-based workflows

CI/CD

MITRE ATT&CK

Threat hunting

Incident response

Detection engineering

Cloud security (AWS/GCP/Azure)

SIEM

Tools

Cribl Stream

Sigma rules

GitHub Actions

Job description

Cribl is seeking a senior security leader to own detection engineering, threat hunting, and incident response. You will design detections as code, map to MITRE ATT&CK, and improve log pipelines across cloud and on-prem environments.

You’ll collaborate with IT, Legal, and Product Security to reduce risk and accelerate detection coverage. The role is remote-first in the US, offering opportunities to shape the security program, mentor teammates, and influence the security roadmap while aligning