Senior Threat Detection Engineer — Detections as Code & IR

Cribl; Hartford (CT); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health, dental, vision

Short-term disability

Life insurance

Paid holidays and PTO

Fertility treatment benefit

401(k) and equity

Job summary

Cribl is seeking a senior security professional to join Team Alpine, protecting Cribl’s telemetry infrastructure. You’ll own detection engineering, threat hunting, and IR rotations, crafting detections, and improving visibility across cloud, SaaS, and identity ecosystems.

You will work in a remote-first environment, partnering with Product Security, IT, and Legal, reporting to the Sr. Director, Security Engineering and Operations under the CISO. Strong Python and KQL skills are essential.

Qualifications

• 5+ years in security operations, with hands-on time in detection engineering, threat hunting, or incident response.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry.
• Take part in the incident response rotation from first alert to closure.
• Assist in ownership of health of security log flow and data pipelines with Cribl Stream.
• Mentor teammates through code review, pairing, and clear documentation.

Skills

Python

Git workflows

KQL

MITRE ATT&CK

Cloud security

SIEM

Threat hunting

Detection engineering

Incident response

Tools

Cribl Stream

Sigma rules

Atomic Red Team

Caldera

GitHub Actions

Job description

Cribl is seeking a senior security professional to join Team Alpine, protecting Cribl’s telemetry infrastructure. You’ll own detection engineering, threat hunting, and IR rotations, crafting detections, and improving visibility across cloud, SaaS, and identity ecosystems.

You will work in a remote-first environment, partnering with Product Security, IT, and Legal, reporting to the Sr. Director, Security Engineering and Operations under the CISO. Strong Python and KQL skills are essential.