Senior Threat Detection Engineer - Remote-First, Detections

Cribl; Frankfort (KY); Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Health benefits

Dental

Vision

Life insurance

Disability

Paid time off

Fertility benefit

401(k)

Equity

Job summary

Cribl, the AI-era telemetry platform, seeks a senior security engineer to join Team Alpine. You’ll own detection engineering, threat hunting, and IR processes, shaping detections as code in a GitOps-driven SIEM pipeline.

You will mentor peers, collaborate with IT and Legal, and help scale Cribl’s security posture across cloud environments. Strong Python, KQL, and MITRE ATT&CK expertise are essential in this remote-first role.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python, Git-based workflows, and CI/CD experience.
• Strong in KQL and MITRE ATT&CK knowledge.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry.
• Take part in the IR rotation: triage, scope, contain, and investigate security incidents from first alert to closure.
• Assist in ownership of health of security log flow and data pipelines with Cribl Stream.
• Mentor teammates through code review, pairing, and documentation.

Skills

Python

KQL

GitOps workflows

CI/CD

Threat hunting

Incident response

Detection engineering

MITRE ATT&CK

Cloud security

Sigma rules

Tools

Cribl Stream

GitHub Actions

SIEM

Job description

Cribl, the AI-era telemetry platform, seeks a senior security engineer to join Team Alpine. You’ll own detection engineering, threat hunting, and IR processes, shaping detections as code in a GitOps-driven SIEM pipeline.

You will mentor peers, collaborate with IT and Legal, and help scale Cribl’s security posture across cloud environments. Strong Python, KQL, and MITRE ATT&CK expertise are essential in this remote-first role.