Senior Threat Detection Engineer (Detection-as-Code & IR)

Cribl; City of Albany (NY); Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

401(k)

Equity

Job summary

Cribl is seeking a senior security engineer to join Team Alpine and drive detection as code across our SIEM and telemetry pipelines. You will hunt threats, build durable detections, and lead incident response for the first 6–12 months while we grow the function.

You’ll own detections, review rule releases, and partner with Product Security, IT, and Legal to close visibility gaps. Strong Python, KQL, and Git workflows are essential.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Experience investigating incidents in cloud (AWS, GCP, and/or Azure), SaaS, and identity providers.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow: issue, pull request, unit and back-testing, then automated deployment
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry
• Lead IR rotations and develop runbooks, and write and maintain detection docs
• Assist in ownership of the health of security log flow and data pipelines with Cribl Stream
• Maintain CI/CD and automation behind the detection program, including GitHub Actions, SIEM API integrations, and AI-assisted gap analysis and PR review
• Mentor teammates through code review and documentation
• Collaborate with IT, Infrastructure, Engineering, and GRC to close visibility gaps

Skills

Python

Git workflows

KQL

Detection engineering

Threat hunting

Incident response

CI/CD

MITRE ATT&CK

Cloud security

Communication

Tools

Cribl Stream

Sigma rules

GitHub Actions

Job description

Cribl is seeking a senior security engineer to join Team Alpine and drive detection as code across our SIEM and telemetry pipelines. You will hunt threats, build durable detections, and lead incident response for the first 6–12 months while we grow the function.

You’ll own detections, review rule releases, and partner with Product Security, IT, and Legal to close visibility gaps. Strong Python, KQL, and Git workflows are essential.