Senior Threat Detection Engineer — Remote & AI-Security

Cribl; Lansing (MI); Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Health insurance

Dental and vision

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility benefit

401(k)

Equity

Job summary

Cribl is hiring for a senior Detection Engineer to own the detections lifecycle, hunt threats, and drive incident response. You will implement detections as code, tune alerting, and ensure log pipelines stay healthy. You will collaborate with Product Security, IT, and Legal, and report to the Sr.

Director of Security Engineering and Operations. You will work across cloud, SaaS, and identity platforms, partner with cross-functional teams, and apply AI-assisted techniques to improve coverage and

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries and working with MITRE ATT&CK.
• Experience investigating incidents in cloud, SaaS, and identity providers.

Responsibilities

• Design, build, test, and tune detections as code (KQL) in a GitOps workflow.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and infra telemetry.
• Participate in incident response rotation from first alert to closure.
• Own health of security log pipelines and data normalization with Cribl Stream.
• Mentor teammates, document runbooks, and improve detection coverage.

Skills

KQL

Python

Git workflows

MITRE ATT&CK

Cloud security

Tools

Cribl Stream

Sigma rules

Job description

Cribl is hiring for a senior Detection Engineer to own the detections lifecycle, hunt threats, and drive incident response. You will implement detections as code, tune alerting, and ensure log pipelines stay healthy. You will collaborate with Product Security, IT, and Legal, and report to the Sr.

Director of Security Engineering and Operations. You will work across cloud, SaaS, and identity platforms, partner with cross-functional teams, and apply AI-assisted techniques to improve coverage and