Senior Threat Detection Engineer - Remote-First (GitOps)

Cribl; Concord (NH); Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Health insurance

Dental

Vision

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is seeking an experienced security engineer to join Team Alpine and own the end-to-end detection lifecycle. You will design detections as code, hunt for threats, and drive incident response while improving log pipelines and data health.

You will work closely with Product Security, IT, and Legal, applying Python, KQL, and MITRE ATT&CK to reduce noise and increase coverage in a remote-first, globally distributed team.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or IR.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and Git-based workflows, code review, and CI/CD.
• KQL proficiency for writing detection queries.
• Knowledge of MITRE ATT&CK and coverage analysis.
• Experience investigating incidents in cloud, SaaS, and identity providers.

Responsibilities

• Design, build, test, and tune detections as code (KQL) via a GitOps workflow.
• Plan and run hypothesis-driven threat hunts across cloud, SaaS, and identity telemetry.
• Lead IR rotation: triage, scope, contain, and investigate incidents end-to-end.
• Own health of security log flow and data pipelines with Cribl Stream.
• Maintain CI/CD and automation behind the detection program (GitHub Actions, SIEM integrations).
• Mentor teammates through code reviews, pairing, and documentation.

Skills

Python

KQL

Git

CI/CD

Threat Hunting

Incident Response

MITRE ATT&CK

SIEM

Data Pipelines

Tools

Sigma rules

Cribl Stream

AWS

GCP

Azure

SIEM APIs

Job description

Cribl is seeking an experienced security engineer to join Team Alpine and own the end-to-end detection lifecycle. You will design detections as code, hunt for threats, and drive incident response while improving log pipelines and data health.

You will work closely with Product Security, IT, and Legal, applying Python, KQL, and MITRE ATT&CK to reduce noise and increase coverage in a remote-first, globally distributed team.