Senior Threat Detection Engineer — Detection-as-Code & IR

Cribl; Washington (District of Columbia); A distancia; USD 180.000 - 240.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Health benefits

Dental & Vision

Short-term disability

Life insurance

Paid holidays & PTO

401(k) & equity

Descripción de la vacante

Cribl is seeking a senior security professional to join Team Alpine and own the detection life cycle from code to production. You will design, tune, and deploy detections, partner with Product Security and IT, and lead investigations during IR rotations.

Expect hands-on work across detection engineering, threat hunting, and incident response while improving detection coverage and log pipelines. You'll work in a remote-first environment with collaboration across security and engineering teams,

Formación

• 5+ years in security operations, with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis.

Responsabilidades

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Map detections to MITRE ATT&CK and close coverage gaps based on threat model.
• Review community and vendor rule releases and decide adoption or adaptation.
• Cut alert noise by tuning and retiring obsolete rules while tracking quality metrics.
• Plan and run hypothesis-driven threat hunts across cloud, SaaS, identity, and endpoints.

Conocimientos

Detection engineering

Python scripting

KQL

MITRE ATT&CK

Cloud/Identity investigations

Log pipelines

Herramientas

Cribl Stream

Sigma rules

Descripción del empleo

Cribl is seeking a senior security professional to join Team Alpine and own the detection life cycle from code to production. You will design, tune, and deploy detections, partner with Product Security and IT, and lead investigations during IR rotations.

Expect hands-on work across detection engineering, threat hunting, and incident response while improving detection coverage and log pipelines. You'll work in a remote-first environment with collaboration across security and engineering teams,