Senior Threat Detection Engineer - Remote & Code-Driven

Cribl; Austin (TX); Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Health, dental, vision

401(k)

Equity

Job summary

Cribl is seeking a senior security engineer to join Team Alpine, focusing on detections as code, threat hunting, and incident response. You will own the detection lifecycle, tune SIEM integrations, and mentor teammates while partnering with Product Security and IT.

This role blends hands-on engineering with governance across security data pipelines. The role emphasizes strong Python and KQL skills, Git-based workflows, and the ability to operate across cloud, SaaS, and identity ecosystems.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfortable with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis.
• Bonus: experience with Cribl Stream or Sigma rules, adversary emulation, or purple teaming.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Map detections to MITRE ATT&CK and identify coverage gaps.
• Review new rule releases and decide on adoption.
• Reduce alert noise and track detection quality metrics.
• Plan and run hypothesis-driven threat hunts across cloud, SaaS, identity, and endpoints.
• Own IR rotation duties and help build runbooks and playbooks.

Skills

Python

KQL

Git

CI/CD

MITRE ATT&CK

Detection engineering

Tools

Cribl Stream

Sigma rules

SIEM

GitHub Actions

Job description

Cribl is seeking a senior security engineer to join Team Alpine, focusing on detections as code, threat hunting, and incident response. You will own the detection lifecycle, tune SIEM integrations, and mentor teammates while partnering with Product Security and IT.

This role blends hands-on engineering with governance across security data pipelines. The role emphasizes strong Python and KQL skills, Git-based workflows, and the ability to operate across cloud, SaaS, and identity ecosystems.