Senior Threat Detection Engineer - Detection-as-Code Leader

Cribl; Olympia (WA); Remote; USD 160,000 - 230,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Disability insurance

Life insurance

Paid holidays

Paid time off

Fertility benefit

401(k)

Equity

Job summary

Cribl is seeking a senior security engineering professional to own detection as code, hunt threats, and drive incident response. You will work within Team Alpine to protect Cribl’s telemetry infrastructure, leveraging Python, KQL, and a GitOps CI/CD process across cloud environments.

You will design detections, map them to MITRE ATT&CK, and improve log pipelines with Cribl Stream. Strong writing, collaboration with IT and Legal, and vendor rule reviews are essential for production readiness.

Qualifications

• 5+ years in security operations with hands-on detection engineering.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and Git-based workflows with CI/CD.
• Proficient in KQL and MITRE ATT&CK for coverage analysis.

Responsibilities

• Design, build, test, detections as code (KQL) in a GitOps workflow.
• Plan and run threat-hunting across cloud, SaaS, identity, and endpoints.
• Lead incident response rotations and develop runbooks for consistency.
• Maintain security log pipelines and Cribl Stream data flows.

Skills

Python

Git workflows

KQL

MITRE ATT&CK

Cloud security

Detection engineering

Threat hunting

Incident response

Tools

Sigma rules

Cribl Stream

GitHub Actions

SIEM APIs

Job description

Cribl is seeking a senior security engineering professional to own detection as code, hunt threats, and drive incident response. You will work within Team Alpine to protect Cribl’s telemetry infrastructure, leveraging Python, KQL, and a GitOps CI/CD process across cloud environments.

You will design detections, map them to MITRE ATT&CK, and improve log pipelines with Cribl Stream. Strong writing, collaboration with IT and Legal, and vendor rule reviews are essential for production readiness.