Senior Threat Detection Engineer - Detection-as-Code & IR

Cribl; Carson City (NV); Remote; USD 140,000 - 190,000; Full time

Job summary

Cribl is seeking a senior security engineer to join Team Alpine, Cribl's internal security team. You will run detections as code, hunt threats, and participate in incident response while owning data pipelines and log health. Collaborate with Product Security, IT, and Legal, reporting to the Sr.

Director, Security Engineering and Operations. You’ll leverage Python, KQL, and GitOps to deploy detections, connect to a modern SIEM, and align with MITRE ATT&CK.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or IR
• Experience writing and maintaining detections as code in a modern SIEM
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD
• Strong in KQL for writing detection queries
• Experience investigating incidents in cloud (AWS, GCP, Azure), SaaS, and identity providers
• Hands-on experience with log pipelines: getting data in, parsing it, fixing it
• Clear writing for incident summaries, runbooks, detection docs
• Bonus: Cribl Stream or other telemetry pipeline tools
• Bonus: Sigma rules, adversary emulation (Atomic Red Team, Caldera, or similar)
• Bonus: agentic or AI-assisted workflows for security operations
• Bonus: certifications such as GCIH, GCDA, or equivalent experience

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow
• Map detections to MITRE ATT&CK, identify coverage gaps and prioritize investments
• Review new community and vendor rule releases and decide adoption
• Reduce alert noise by tuning and retiring outdated rules
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, and endpoints
• Run IR rotation: triage, scope, contain, investigate incidents
• Write and maintain runbooks for consistent incident response
• Own health of security log flow and data pipelines with Cribl Stream
• Manage CI/CD and automation behind the detection program (GitHub Actions, SIEM APIs)
• Mentor teammates via code reviews, pairing, and documentation
• Collaborate with IT, Infrastructure, Engineering, and GRC to close visibility gaps

Skills

Security operations

Detections as code

Python

Git

KQL

MITRE ATT&CK

Cloud (AWS/GCP/Azure)

Incident response

SIEM

Detections engineering

CI/CD

AI-assisted workflows

Communication writing

Tools

Cribl Stream

Sigma rules

Atomic Red Team

Caldera

GitHub Actions

SIEM

Job description

Cribl is seeking a senior security engineer to join Team Alpine, Cribl's internal security team. You will run detections as code, hunt threats, and participate in incident response while owning data pipelines and log health. Collaborate with Product Security, IT, and Legal, reporting to the Sr.

Director, Security Engineering and Operations. You’ll leverage Python, KQL, and GitOps to deploy detections, connect to a modern SIEM, and align with MITRE ATT&CK.