Senior Threat Detection Engineer - Detection-as-Code

Cribl; Phoenix (AZ); Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Health, dental, vision

401(k) with company match

Equity

Paid holidays and time off

Fertility treatment benefit

Job summary

Cribl is hiring for a senior security engineer to join the internal security team. You will design and implement detections as code, align coverage with MITRE ATT&CK, and reduce alert noise. You will hunt across cloud, SaaS, identity, and endpoints, and contribute to incident response rotations.

You’ll own data pipelines and CI/CD for the detection program. The role emphasizes hands-on work, collaboration with IT, Legal, and Product Security, and opportunities to shape detection culture in a

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Proficiency in writing detection queries with KQL and knowledge of MITRE ATT&CK.

Responsibilities

• Design, build, test, and tune detections as code through a GitOps workflow.
• Plan and run hypothesis-driven threat hunts across cloud, SaaS, identity, and endpoints.
• Take part in the incident response rotation and convert findings into new detections and runbooks.
• Maintain health of security data pipelines and CI/CD behind the detection program.

Skills

Security operations

Detection engineering

Threat hunting

Incident response

Python

KQL

Git workflows

SIEM

Tools

Cribl Stream

Sigma rules

SIEM integrations

Job description

Cribl is hiring for a senior security engineer to join the internal security team. You will design and implement detections as code, align coverage with MITRE ATT&CK, and reduce alert noise. You will hunt across cloud, SaaS, identity, and endpoints, and contribute to incident response rotations.

You’ll own data pipelines and CI/CD for the detection program. The role emphasizes hands-on work, collaboration with IT, Legal, and Product Security, and opportunities to shape detection culture in a