Senior Threat Detection Engineer: Detection as Code & IR

Cribl; Topeka (KS); A distancia; USD 150.000 - 190.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Health benefits

Dental benefits

Vision benefits

Short-term disability

Life insurance

Paid holidays & time off

Fertility treatment benefit

401(k)

Equity

Descripción de la vacante

Cribl, the AI-era telemetry platform, seeks an experienced security engineering leader to join Team Alpine. You will own the detection lifecycle, hunt threats across cloud, SaaS, identity, and endpoints, and participate in the incident response rotation during the first 6–12 months.

You’ll own log pipelines, drive data health, and collaborate with Product Security, IT, and Legal to close visibility gaps. You will design and implement detections, participate in CI/CD workflows, and help shape the

Formación

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis, not just labeling.

Responsabilidades

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow, with automated deployment.
• Map detections to MITRE ATT&CK and identify coverage gaps based on threat model.
• Review new rule releases and decide adoption, adaptation, or removal.
• Reduce alert noise by tuning and retiring outdated rules and tracking detection quality metrics.

Conocimientos

Python

KQL

Git-based workflows

CI/CD

MITRE ATT&CK

Threat hunting

Incident response

Cloud (AWS/GCP/Azure)

Log pipelines

Detections as code

Herramientas

Cribl Stream

SIEM

Sigma rules

Atomic Red Team

Caldera

GitHub Actions

SIEM integrations

Descripción del empleo

Cribl, the AI-era telemetry platform, seeks an experienced security engineering leader to join Team Alpine. You will own the detection lifecycle, hunt threats across cloud, SaaS, identity, and endpoints, and participate in the incident response rotation during the first 6–12 months.

You’ll own log pipelines, drive data health, and collaborate with Product Security, IT, and Legal to close visibility gaps. You will design and implement detections, participate in CI/CD workflows, and help shape the