Senior Threat Detection Engineer: Detection-as-Code & IR

Cribl; Salem (OR); Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Health insurance

Dental & Vision

401(k) and equity

Paid holidays

Paid time off

Fertility benefit

Job summary

Cribl is seeking an experienced security engineer to own detection engineering, threat hunting, and incident response within our internal security team, Team Alpine. You’ll design detections as code, map to MITRE ATT&CK, and partner with Product Security, IT, and Legal to close visibility gaps.

Bring hands-on expertise in Python, KQL, and Git-based workflows, plus hands-on experience with log pipelines and Cribl Stream.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.

Responsibilities

• Design, build, test, and tune detections as code through a GitOps workflow with CI/CD integration.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and infra telemetry.
• Participate in incident response rotation and drive runbooks, retrospectives, and detection updates.
• Own health of security log flow, data parsing, and integration with Cribl Stream and SIEM pipelines.
• Mentor teammates and collaborate with IT, Infra, Engineering, and GRC to close visibility gaps.

Skills

Python

KQL

Git

CI/CD

MITRE ATT&CK

Threat hunting

Incident response

Detections as code

Tools

Cribl Stream

Sigma

GitHub Actions

SIEM

Job description

Cribl is seeking an experienced security engineer to own detection engineering, threat hunting, and incident response within our internal security team, Team Alpine. You’ll design detections as code, map to MITRE ATT&CK, and partner with Product Security, IT, and Legal to close visibility gaps.

Bring hands-on expertise in Python, KQL, and Git-based workflows, plus hands-on experience with log pipelines and Cribl Stream.