Senior Threat Detection Engineer (Detection-as-Code)

Cribl; Lincoln (NE); Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Disability insurance

Life insurance

Paid holidays

Paid time off

Fertility benefit

401(k)

Equity

Job summary

Cribl is seeking a senior security engineer to join Team Alpine, focusing on detection engineering, threat hunting, and incident response. You will own detections as code, tune SIEM pipelines, and mentor teammates.

You'll work across IT, Product Security, Legal, and GRC, reporting to the Sr. Director, Security Engineering and Operations. Remote-friendly with hands-on responsibilities and cross-team collaboration.

Qualifications

• 5+ years in security operations with hands-on detection work.
• Experience writing/maintaining detections as code in a modern SIEM.
• Strong Python and Git-based CI/CD experience.

Responsibilities

• Design, build, test and tune detections as code (KQL) in a GitOps flow.
• Plan and run threat hunts across cloud, SaaS, identity and endpoints.
• Lead incident response rotation and write/runbooks for repeatable playbooks.
• Maintain health of log pipelines and data routing with Cribl Stream.

Skills

Detections as code

KQL

Python

Git-based workflows

Threat hunting

Incident response

SIEM basics

Log pipelines

Tools

Cribl Stream

Sigma rules

Atomic Red Team

Caldera

GitHub Actions

SIEM APIs

Job description

Cribl is seeking a senior security engineer to join Team Alpine, focusing on detection engineering, threat hunting, and incident response. You will own detections as code, tune SIEM pipelines, and mentor teammates.

You'll work across IT, Product Security, Legal, and GRC, reporting to the Sr. Director, Security Engineering and Operations. Remote-friendly with hands-on responsibilities and cross-team collaboration.