Senior Threat Detection Engineer — Detection as Code

Cribl; Montgomery (AL); Remote; USD 150,000 - 230,000; Full time

Benefits offered by this job

Health insurance

Remote-first culture

Job summary

Cribl seeks a senior Detection Engineer to join Team Alpine, protecting Cribl itself. You will design, build, test, and tune detections as code in a GitOps pipeline, map detections to MITRE ATT&CK, and reduce alert noise while improving coverage across cloud, SaaS, and identity realms.

You will lead investigations during the initial IR rotation and drive runbooks, detections, and data pipelines to ensure healthy telemetry before it reaches the SIEM.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or IR.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python and Git-based workflows, CI/CD experience.
• Proficient in writing detection queries with KQL and MITRE ATT&CK mapping.
• Experience investigating incidents in cloud, SaaS, and identity providers.
• Hands-on with log pipelines: data intake, parsing, and fixes.
• Clear writing for incident summaries, runbooks and docs.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Map detections to MITRE ATT&CK and identify coverage gaps for investment decisions.
• Review new community and vendor rule releases and decide adoption.
• Cut alert noise by tuning and retiring outdated rules; track quality metrics.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, and endpoints.
• Turn hunt findings into durable detections, docs, and backlog items.
• Lead IR rotation for 6-12 months; conduct retrospectives and playbook updates.
• Own security log flow health and Cribl Stream data pipelines; CI/CD & API integrations.
• Collaborate with IT, Infrastructure, Engineering, and GRC to close visibility gaps.

Skills

Python

KQL

Git

CI/CD

MITRE ATT&CK

SIEM

Threat hunting

Incident response

Sigma rules

Adversary emulation

Cribl Stream

Tools

Cribl Stream

GitHub Actions

Atomic Red Team

Caldera

Job description

Cribl seeks a senior Detection Engineer to join Team Alpine, protecting Cribl itself. You will design, build, test, and tune detections as code in a GitOps pipeline, map detections to MITRE ATT&CK, and reduce alert noise while improving coverage across cloud, SaaS, and identity realms.

You will lead investigations during the initial IR rotation and drive runbooks, detections, and data pipelines to ensure healthy telemetry before it reaches the SIEM.