Senior Threat Detection Engineer - Detection-as-Code

Cribl; Helena (MT); Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

401(k) plan

Equity

Paid holidays

Paid time off

Fertility treatment benefit

Life insurance

Job summary

Cribl is seeking a senior security engineer to own the detection lifecycle, from code to incident response. You will design detections, hunt threats, and drive IR rotations, partnering with Product Security, IT, and Legal.

You will own data pipelines and CI/CD for the detection program, ensuring robust log health across cloud and on-prem environments. You will work in a remote-first team, contribute to runbooks, and mentor teammates while advancing detections that scale with enterprise telemetry

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis, not just labeling.
• Experience investigating incidents in cloud (AWS, GCP, and/or Azure), SaaS, and identity providers.
• Hands-on experience with log pipelines: getting data in, parsing it, and fixing it when it breaks.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow, with automated deployment.
• Plan and run threat hunts across cloud, SaaS, identity, endpoint, and infra telemetry.
• Lead incident response rotations and turn lessons into detections and runbooks.
• Maintain health of security log flow and data pipelines with Cribl Stream.
• Collaborate with IT, Infra, Engineering, and GRC to close visibility gaps.

Skills

Python

KQL

Git & CI/CD

Detections as code

MITRE ATT&CK

Cloud security

SIEM

Threat hunting

Incident response

Tools

Cribl Stream

GitHub Actions

SIEM APIs

Job description

Cribl is seeking a senior security engineer to own the detection lifecycle, from code to incident response. You will design detections, hunt threats, and drive IR rotations, partnering with Product Security, IT, and Legal.

You will own data pipelines and CI/CD for the detection program, ensuring robust log health across cloud and on-prem environments. You will work in a remote-first team, contribute to runbooks, and mentor teammates while advancing detections that scale with enterprise telemetry