Senior Threat Detection Engineer - Remote-First

Cribl; Jackson (MS); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health insurance

Dental

Vision

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility benefit

401(k)

Equity

Job summary

Cribl is seeking an senior Security Operations professional to join Team Alpine. You will design, implement, and tune detections as code, hunt threats, and drive incident response. You will own log pipeline health and work with Cribl Stream to optimise telemetry before it reaches the SIEM.

You will collaborate with Product Security, IT, and Legal and report to the Sr. Director, Security Engineering and Operations under the CISO.

Qualifications

• 5+ years in security operations with hands-on time in detection, hunting or IR.
• Experience writing and maintaining detections in a modern SIEM.
• Strong Python and Git / CI/CD experience.
• Strong KQL skills for detection queries.
• Familiarity with MITRE ATT&CK and coverage analysis.
• Experience with cloud providers (AWS, Azure, GCP) and SaaS.
• Hands-on with log pipelines and data flow.
• Clear writing for technical and non-technical audiences.
• Bonus: Cribl Stream or Sigma rules or adversary emulation.
• Bonus: AI-assisted workflows.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Map detections to MITRE ATT&CK, assess coverage gaps, prioritize investments.
• Review new community and vendor rule releases and decide adoption.
• Reduce alert noise by tuning and retiring rules as needed.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, and endpoints.
• Lead IR rotation activities and develop runbooks and post-incident reviews.
• Own health of security log flow and data pipelines with Cribl Stream.

Skills

Security operations

Detection engineering

Threat hunting

Incident response

Python

KQL

Git workflows

MITRE ATT&CK

Cloud security

Sigma rules

Adversary emulation

Cribl Stream

AI workflows

Tools

GitHub Actions

SIEM

Job description

Cribl is seeking an senior Security Operations professional to join Team Alpine. You will design, implement, and tune detections as code, hunt threats, and drive incident response. You will own log pipeline health and work with Cribl Stream to optimise telemetry before it reaches the SIEM.

You will collaborate with Product Security, IT, and Legal and report to the Sr. Director, Security Engineering and Operations under the CISO.