Senior Threat Detection Engineer - Remote, Detection Code

Cribl; San Francisco (CA); À distance; USD 150 000 - 210 000; Plein temps

Avantages offerts par ce poste

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility benefit

401(k)

Equity

Résumé du poste

Cribl builds telemetry infrastructure for some of the world's biggest security teams. Now we're looking for someone to protect Cribl itself. You'll join Cribl's internal security team, Team Alpine, to run detection as code and lead the full detection lifecycle.

You will hunt, respond, and own log pipelines, with impact across product security, IT, and Legal. Partner closely with stakeholders, mentor teammates, and write clear runbooks and detections.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK for coverage analysis.
• Experience investigating incidents in cloud, SaaS, and identity providers.
• Hands-on experience with log pipelines: getting data in, parsing it, and fixing it when it breaks.

Responsabilités

• Design, build, test, and tune detections as code through a GitOps workflow.
• Map detections to MITRE ATT&CK and identify coverage gaps.
• Review new rule releases and decide adoption or adaptation.
• Cut alert noise by tuning and retiring outdated rules.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, and infrastructure telemetry.
• Turn hunt findings into durable detections, documentation, and backlog items.
• Take part in the incident response rotation: triage, scope, contain, and investigate incidents.
• Maintain health of security log flow and data pipelines with Cribl Stream.
• Own CI/CD and automation behind the detection program.

Connaissances

Detection engineering

Threat hunting

Incident response

Python

Git workflows

KQL

MITRE ATT&CK

Cloud security

SIEM

Log pipelines

Adversary emulation

CI/CD

Cribl Stream

Sigma rules

Formation

Bachelor's degree

Outils

Cribl Stream

Sigma

Description du poste

Cribl builds telemetry infrastructure for some of the world's biggest security teams. Now we're looking for someone to protect Cribl itself. You'll join Cribl's internal security team, Team Alpine, to run detection as code and lead the full detection lifecycle.

You will hunt, respond, and own log pipelines, with impact across product security, IT, and Legal. Partner closely with stakeholders, mentor teammates, and write clear runbooks and detections.