Senior Threat Detection Engineer (Detection-as-Code)

Cribl; Little Rock (AR); Remote; USD 130,000 - 190,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is seeking a senior security engineer to drive detection engineering, threat hunting, incident response, and log-pipeline health. You will own detections as code, map to MITRE ATT&CK, review rules, and reduce alert noise while expanding coverage across cloud and SaaS telemetry.

You will collaborate with Product Security, IT, Legal, and GRC, and participate in IR rotations while maturing playbooks and runbooks. Strong Python and CI/CD skills are essential.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate telemetry.
• Take part in the incident response rotation from first alert to closure.
• Maintain health of security log flow; onboard sources and monitor data quality.
• Own CI/CD and automation behind the detection program, including GitHub Actions and SIEM integrations.

Skills

Security operations

Detection engineering

Threat hunting

Incident response

Python

Git workflows

KQL

MITRE ATT&CK

Cloud security

SIEM

Tools

Cribl Stream

Sigma rules

Atomic Red Team

Job description

Cribl is seeking a senior security engineer to drive detection engineering, threat hunting, incident response, and log-pipeline health. You will own detections as code, map to MITRE ATT&CK, review rules, and reduce alert noise while expanding coverage across cloud and SaaS telemetry.

You will collaborate with Product Security, IT, Legal, and GRC, and participate in IR rotations while maturing playbooks and runbooks. Strong Python and CI/CD skills are essential.