Senior Threat Detection Engineer – IR & SIEM Automation

Cribl; Salt Lake City (UT); Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is seeking a hands-on Senior Security Engineer to own the end-to-end detection lifecycle, hunt threats, and drive incident response. You will improve log pipelines, partner with product security, IT, and legal, and own detections from concept to production.

The role emphasizes using detection as code, Git-based workflows, and CI/CD, with exposure to Cribl Stream, Sigma rules, and SIEM integrations. Remote-first across our global team.

Qualifications

• 5+ years in security operations, with hands-on time in detection engineering, threat hunting, or IR.
• Experience writing detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.

Responsibilities

• Design, build, test, and tune detections as code using a GitOps workflow.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and infrastructure telemetry.
• Lead IR rotation, triage, scope, contain, and investigate incidents from alert to closure.

Skills

Python

KQL

Git & CI/CD

MITRE ATT&CK

Cloud (AWS, GCP, Azure)

Incident response

Detection engineering

Tools

Cribl Stream

Sigma rules

SIEM

GitHub Actions

Job description

Cribl is seeking a hands-on Senior Security Engineer to own the end-to-end detection lifecycle, hunt threats, and drive incident response. You will improve log pipelines, partner with product security, IT, and legal, and own detections from concept to production.

The role emphasizes using detection as code, Git-based workflows, and CI/CD, with exposure to Cribl Stream, Sigma rules, and SIEM integrations. Remote-first across our global team.