Senior Threat Detection Engineer — Remote-First

Cribl; Springfield (IL); A distancia; USD 140.000 - 170.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Health insurance

Dental

Vision

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility benefit

401(k)

Equity

Descripción de la vacante

Cribl is seeking a senior Security Engineer to join Team Alpine, protecting Cribl's telemetry and detection pipelines. You'll lead detections as code, hunt threats, and participate in incident response rotations while shaping how we detect adversaries across cloud and on-prem systems.

You will collaborate with Product Security, IT, and Legal, owning data flows, log pipelines, and runbooks. Strong Python and KQL skills required.

Formación

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Knowledge of MITRE ATT&CK used for coverage analysis.
• Experience investigating incidents in cloud, SaaS, and identity providers.
• Hands-on experience with log pipelines and data flow health.

Responsabilidades

• Design, build, test, and tune detections as code in a GitOps workflow.
• Map detections to MITRE ATT&CK and identify coverage gaps.
• Review new community and vendor rules and decide adoption.
• Reduce alert noise while maintaining detection quality metrics.
• Plan and run hunts across cloud, SaaS, identity, and endpoints.
• Drive IR rotations, runbooks, and post-incident improvements.
• Own data pipelines and health of security log flow with Cribl Stream.

Conocimientos

Detection engineering

Threat hunting

Incident response

Python

Git-based workflows

KQL

MITRE ATT&CK

Cloud security

SIEM

Herramientas

Cribl Stream

Sigma rules

Atomic Red Team

Caldera

GitHub Actions

Descripción del empleo

Cribl is seeking a senior Security Engineer to join Team Alpine, protecting Cribl's telemetry and detection pipelines. You'll lead detections as code, hunt threats, and participate in incident response rotations while shaping how we detect adversaries across cloud and on-prem systems.

You will collaborate with Product Security, IT, and Legal, owning data flows, log pipelines, and runbooks. Strong Python and KQL skills required.