Senior Threat Detection Engineer - Detection as Code

Cribl; Denver (CO); Remote; USD 150,000 - 200,000; Full time

Benefits offered by this job

Health benefits

Dental & Vision

Paid holidays

Paid time off

Fertility benefit

401(k) & equity

Job summary

Cribl is seeking a hands-on Senior Security Engineer to join Team Alpine and own the detection lifecycle. You will design detections as code, reduce alert noise, and map rules to MITRE ATT&CK while collaborating with IT, Legal, and Product Security.

You’ll also run IR rotations and help harden log pipelines across cloud and on‑premise environments. You'll apply strong Python, KQL, and Git workflows, and contribute to a data-driven security program with Cribl Stream and Sigma rule usage.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow with CI/CD.
• Plan and run threat hunts across cloud, SaaS, identity, endpoint, and infrastructure telemetry.
• Lead IR investigations from first alert to closure and drive improvements in playbooks.
• Own the health of security log flow and data pipelines, including Cribl Stream integrations.
• Mentor teammates through code reviews, pairing, and documentation.

Skills

Python

KQL

Git-based workflows

CI/CD

Threat hunting

Incident response

Detection engineering

MITRE ATT&CK

Cloud experience

Sigma rules

Adversary emulation

Cribl Stream

Tools

Cribl Stream

GitHub Actions

Sigma rules

Atomic Red Team

Caldera

SIEM

Job description

Cribl is seeking a hands-on Senior Security Engineer to join Team Alpine and own the detection lifecycle. You will design detections as code, reduce alert noise, and map rules to MITRE ATT&CK while collaborating with IT, Legal, and Product Security.

You’ll also run IR rotations and help harden log pipelines across cloud and on‑premise environments. You'll apply strong Python, KQL, and Git workflows, and contribute to a data-driven security program with Cribl Stream and Sigma rule usage.