Senior Threat Detection Engineer - Detection-as-Code & IR

Cribl; Harrisburg (Dauphin County); Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Health, dental, vision

401(k) and equity

Paid holidays and PTO

Fertility treatment benefit

Job summary

Cribl is seeking a senior security engineer to own the end-to-end detection lifecycle, from writing detections in code to hunting threats in cloud and on-prem systems. You will tune log pipelines, review new rule releases, and partner with IT, Legal, and Product Security to improve visibility and response.

You will contribute to incident response and build scalable detection infrastructures using Cribl Stream, Sigma rules, and modern SIEMs.

Qualifications

• 5+ years in security operations with hands-on detection engineering, threat hunting, or IR.
• Experience writing detections as code in a modern SIEM.
• Strong Python, Git-based workflows, CI/CD.
• Proficiency with KQL and MITRE ATT&CK mapping.
• Experience with cloud environments (AWS, GCP, Azure) and identity providers.
• Familiarity with log pipelines and telemetry tooling.

Responsibilities

• Design, build, test, and tune detections as code (KQL) via a GitOps workflow.
• Map detections to MITRE ATT&CK and identify coverage gaps.
• Review new community and vendor rule releases and decide adoption.
• Reduce alert noise by tuning and retiring outdated rules.
• Hunt across cloud, SaaS, identity, endpoint, and corporate telemetry.
• Use adversary emulation to generate test events for detections.
• Turn hunt findings into durable detections and backlog items.
• Participate in IR rotation: triage, scope, contain, and investigate incidents.
• Maintain log pipelines health and onboard new sources with Cribl Stream.
• Own CI/CD and automation behind the detection program (GitHub Actions, SIEM integrations).
• Mentor teammates; document detections, runbooks, and processes.

Skills

Python

KQL

Git-based workflows

SIEM concepts

MITRE ATT&CK

Threat hunting

Incident response

Log pipelines

Cloud (AWS/GCP/Azure)

Cribl Stream (bonus)

Tools

Sigma rules

Atomic Red Team

Caldera

Job description

Cribl is seeking a senior security engineer to own the end-to-end detection lifecycle, from writing detections in code to hunting threats in cloud and on-prem systems. You will tune log pipelines, review new rule releases, and partner with IT, Legal, and Product Security to improve visibility and response.

You will contribute to incident response and build scalable detection infrastructures using Cribl Stream, Sigma rules, and modern SIEMs.