Senior Threat Detection Engineer - Detection as Code & IR

Cribl; Sacramento (CA); Remote; USD 180,000 - 230,000; Full time

Job summary

Cribl is seeking a senior security engineer to own detection engineering, threat hunting, and incident response. You will design detections as code, map to MITRE ATT&CK, and reduce alert noise while improving log pipelines and SIEM integrations.

You will mentor teammates and help build out a robust detection program across cloud, SaaS, and identity telemetry. Join Cribl’s security team at a remote-friendly home base in the United States, with collaboration across IT, Legal, and Product Security.

Qualifications

• 5+ years in security operations with hands-on detection engineering or IR.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and Git-based workflows.
• Proficient in KQL and MITRE ATT&CK for coverage analysis.
• Experience investigating incidents in cloud environments (AWS/GCP/Azure).
• Hands-on with log pipelines: ingestion, parsing, normalization, and fixes.
• Ability to produce clear incident summaries and runbooks.
• Bonus: Cribl Stream, Sigma rules, or AI-assisted workflows.

Responsibilities

• Design, build, test, and tune detections as code in a GitOps workflow.
• Plan and execute threat hunts across cloud, SaaS, identity, and endpoints.
• Lead IR rotation for initial incident response and post-mincident improvements.
• Own health of security log flow and data pipelines with Cribl Stream.
• Collaborate with IT, Engineering, and Legal to close visibility gaps.

Skills

Security operations

Detection engineering

Threat hunting

Incident response

Python

KQL

MITRE ATT&CK

Cloud security

AI-assisted tooling

Tools

Cribl Stream

GitHub Actions

SIEM

Adversary emulation tools

Job description

Cribl is seeking a senior security engineer to own detection engineering, threat hunting, and incident response. You will design detections as code, map to MITRE ATT&CK, and reduce alert noise while improving log pipelines and SIEM integrations.

You will mentor teammates and help build out a robust detection program across cloud, SaaS, and identity telemetry. Join Cribl’s security team at a remote-friendly home base in the United States, with collaboration across IT, Legal, and Product Security.