Senior Threat Detection Engineer — Detection-as-Code Lead

Cribl; Des Moines (IA); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is hiring for a senior security engineer to join Team Alpine, focusing on detection as code, threat hunting, and incident response. You will design detections in KQL, map to MITRE ATT&CK, and help maintain log pipelines with Cribl Stream, working in a GitOps framework.

You will collaborate with Product Security, IT, and Legal, reporting to the Sr. Director of Security Engineering and Operations. This is a remote-first role with competitive salary and benefits for the AI era.

Qualifications

• 5+ years in security operations, with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Map detections to MITRE ATT&CK, identify coverage gaps, and prioritize investments.
• Review new community and vendor rule releases (Sigma, etc.) and decide adoption.
• Cut alert noise by tuning/removing obsolete rules and tracking detection quality metrics.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infra telemetry.
• Take part in the incident response rotation: triage, scope, contain, investigate incidents from first alert to closure.
• Assist in ownership of security log pipelines and Cribl Stream data routing and normalization.
• Maintain CI/CD and automation behind the detection program (GitHub Actions, SIEM APIs).
• Mentor teammates through code review and documentation.

Skills

Python

KQL

Git workflows

MITRE ATT&CK

SIEM

Threat hunting

Incident response

Detections as code

Detection engineering

Tools

Cribl Stream

Sigma rules

GitHub Actions

CI/CD

Job description

Cribl is hiring for a senior security engineer to join Team Alpine, focusing on detection as code, threat hunting, and incident response. You will design detections in KQL, map to MITRE ATT&CK, and help maintain log pipelines with Cribl Stream, working in a GitOps framework.

You will collaborate with Product Security, IT, and Legal, reporting to the Sr. Director of Security Engineering and Operations. This is a remote-first role with competitive salary and benefits for the AI era.