Senior Threat Detection Engineer — Remote-First

Cribl; Atlanta (GA); À distance; USD 120 000 - 210 000; Plein temps

Avantages offerts par ce poste

Health benefits

401(k) + equity

Paid time off

Fertility treatment benefit

Résumé du poste

Cribl is seeking a senior security engineer to own detection engineering, threat hunting, and incident response. You will design detections as code, map to MITRE ATT&CK, and integrate with our SIEM and Cribl Stream.

You’ll lead IR rotations, mentor teammates, and collaborate with IT, Product Security, and Legal. This hands-on role emphasizes building clear runbooks and improving visibility across telemetry pipelines.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Experience investigating incidents in cloud (AWS, GCP, and/or Azure), SaaS, and identity providers.
• Hands-on experience with log pipelines: getting data in, parsing it, and fixing it when it breaks.
• Clear writing for both technical and non-technical audiences: incident summaries, runbooks, detection docs.

Responsabilités

• Design, build, test, and tune detections as code through a GitOps workflow.
• Map detections to MITRE ATT&CK and identify coverage gaps for prioritization.
• Review new rule releases and decide adoption or adaptation.
• Cut alert noise by tuning and retiring stale rules while tracking quality.

Connaissances

Security operations

Detections as code (KQL)

Python

Git workflows

MITRE ATT&CK

Cloud security

Incident response

CI/CD

Log pipelines

Communication

Outils

Cribl Stream

SIEM

GitHub Actions

Description du poste

Cribl is seeking a senior security engineer to own detection engineering, threat hunting, and incident response. You will design detections as code, map to MITRE ATT&CK, and integrate with our SIEM and Cribl Stream.

You’ll lead IR rotations, mentor teammates, and collaborate with IT, Product Security, and Legal. This hands-on role emphasizes building clear runbooks and improving visibility across telemetry pipelines.