Senior Threat Detection Engineer – Remote & Detection-as-Code

Cribl; Raleigh (NC); Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

401(k)

Job summary

Cribl is seeking a senior security engineer to run detection as code, hunt for threats, and lead incident response. You will own the health of log pipelines, build detections in a GitOps workflow, and collaborate across IT, Product Security, and Legal. Strong Python, KQL, and cloud security experience are essential.

You’ll join a remote-first team with a focus on telemetry infrastructure, reporting to the Sr. Director, Security Engineering and Operations under the CISO.

Qualifications

• 5+ years in security operations, with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis, not just labeling.
• Experience investigating incidents in cloud, SaaS, and identity providers.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow and automated deployment.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry.
• Lead IR rotation activities, triage and investigate security incidents from first alert to closure.
• Own health of security log flow and data pipelines, onboarding sources and normalization.
• Mentor teammates through code review, pairing, and documentation.
• Collaborate with Product Security, IT, and Legal to close visibility gaps.

Skills

Detection engineering

Threat hunting

Incident response

Python

Git-based workflows

KQL

MITRE ATT&CK

Cloud security (AWS/GCP/Azure)

SIEM

Log pipelines

Tools

Cribl Stream

Sigma rules

CI/CD (GitHub Actions)

Job description

Cribl is seeking a senior security engineer to run detection as code, hunt for threats, and lead incident response. You will own the health of log pipelines, build detections in a GitOps workflow, and collaborate across IT, Product Security, and Legal. Strong Python, KQL, and cloud security experience are essential.

You’ll join a remote-first team with a focus on telemetry infrastructure, reporting to the Sr. Director, Security Engineering and Operations under the CISO.