Senior Threat Detection Engineer - Detection-as-Code & IR

Cribl; Trenton (NJ); Remote; USD 180,000 - 210,000; Full time

Benefits offered by this job

Health insurance

Dental

Vision

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl, the AI era telemetry platform, seeks a hands-on Senior Security Engineer in a remote-first role based in the United States. You will own detection engineering, threat hunting, and incident response for our internal security program, shaping detections and runbooks that protect Cribl and its customers.

You’ll design detections as code in a GitOps workflow, map coverage to MITRE ATT&CK, and collaborate with Product Security, IT, and Legal.

Qualifications

• 5+ years in security operations, with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow: issue, pull request, unit and back-testing, then automated deployment
• Map detections to MITRE ATT&CK, find coverage gaps, and decide where to invest next based on our threat model
• Review new community and vendor rule releases, such as Sigma, and decide what to adopt, adapt, or skip
• Cut alert noise by tuning, retiring rules that no longer earn their place, and tracking detection quality metrics
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry
• Use adversary emulation to generate test events for detections that have nothing to fire on yet
• Turn hunt findings into durable detections, documentation, and backlog items
• Take part in IR rotation: triage, scope, contain, and investigate security incidents from first alert to closure
• Run retrospectives and turn the lessons into new detections, playbook updates, and fixes to visibility gaps
• Write and maintain runbooks so others on the team can respond consistently
• Assist in ownership of health of security log flow and data pipelines with Cribl Stream
• Maintain CI/CD and automation behind the detection program, including GitHub Actions, SIEM integrations, and AI gap analysis

Skills

Python

Git workflows

KQL

MITRE ATT&CK

Threat hunting

Incident response

Detections as code

Cloud security

Tools

Cribl Stream

Sigma rules

SIEM

Job description

Cribl, the AI era telemetry platform, seeks a hands-on Senior Security Engineer in a remote-first role based in the United States. You will own detection engineering, threat hunting, and incident response for our internal security program, shaping detections and runbooks that protect Cribl and its customers.

You’ll design detections as code in a GitOps workflow, map coverage to MITRE ATT&CK, and collaborate with Product Security, IT, and Legal.