Senior Threat Detection Engineer (Detection-as-Code)

Cribl; Honolulu (HI); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k) and equity

Job summary

Cribl is seeking a senior security engineer to join Team Alpine, protecting Cribl's telemetry infrastructure with hands-on detection engineering, threat hunting, and incident response. You will own detections as code, map to MITRE ATT&CK, and drive improvements across log pipelines.

You will collaborate with Product Security, IT, and Legal, participate in IR rotations for 6–12 months, and help scale detections to production while documenting runbooks and best practices.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Working knowledge of MITRE ATT&CK and how to apply it for coverage analysis.

Responsibilities

• Design, build, test, and tune detections as code (KQL) in a GitOps workflow.
• Plan and run hypothesis-driven threat hunts across cloud, SaaS, identity, and endpoints.
• Lead incident response rotations and drive post-incident improvements.
• Maintain health of security log pipelines and data flows across Cribl Stream.
• Collaborate with Product Security, IT, and Legal to close visibility gaps.

Skills

Python

KQL

Detections as code

Log pipelines

MITRE ATT&CK

Git-based workflows

CI/CD

SIEM

Tools

GitHub Actions

Cribl Stream

Sigma rules

Atomic Red Team

Caldera

Job description

Cribl is seeking a senior security engineer to join Team Alpine, protecting Cribl's telemetry infrastructure with hands-on detection engineering, threat hunting, and incident response. You will own detections as code, map to MITRE ATT&CK, and drive improvements across log pipelines.

You will collaborate with Product Security, IT, and Legal, participate in IR rotations for 6–12 months, and help scale detections to production while documenting runbooks and best practices.