Senior Threat Detection Engineer - Detection-as-Code & SIEM

Cribl; Indianapolis (IN); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off (PTO)

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is seeking a senior security engineer to help protect our telemetry platform and customers by building and maintaining detections as code within a modern SIEM. You’ll work on detection engineering, threat hunting, and incident response as part of the internal security team, collaborating with Product Security, IT, and Legal.

You will own the health of log pipelines, integrate with Cribl Stream, and refine detections through CI/CD, Git-based workflows, and AI-assisted analysis.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries and knowledge of MITRE ATT&CK.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow and automated deployment.
• Plan and run hypothesis-driven threat hunts across cloud, SaaS, identity, endpoint, and infrastructure telemetry.
• Take part in the IR rotation: triage, scope, contain, and investigate security incidents to closure.
• Assist in ownership of health of security log flow and data pipelines, plus CI/CD and automation behind the detection program.
• Mentor teammates and collaborate with IT, Infrastructure, Engineering, and GRC to close visibility gaps.

Skills

Python

KQL

Git

CI/CD

Threat hunting

Adversary emulation

MITRE ATT&CK

Detections as code

Cloud security

Tools

Cribl Stream

Sigma rules

GitHub Actions

CI/CD tooling

Job description

Cribl is seeking a senior security engineer to help protect our telemetry platform and customers by building and maintaining detections as code within a modern SIEM. You’ll work on detection engineering, threat hunting, and incident response as part of the internal security team, collaborating with Product Security, IT, and Legal.

You will own the health of log pipelines, integrate with Cribl Stream, and refine detections through CI/CD, Git-based workflows, and AI-assisted analysis.