Senior Threat Detection Engineer - Remote SIEM & IR Lead

Cribl; Tallahassee (FL); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment

401(k)

Equity

Job summary

Cribl is seeking a senior security engineer to join Team Alpine, focusing on detection engineering, threat hunting, and incident response. You’ll design detections as code (KQL) and map detections to MITRE ATT&CK, while owning log pipelines with Cribl Stream.

Collaborate with Product Security, IT, and Legal, lead IR rotations for 6–12 months, and contribute to CI/CD, runbooks, and detection documentation. You will mentor teammates and drive robust security operations.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow, with unit and back-testing and automated deployment.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry.
• Take part in the incident response rotation, triage, scope, contain, and investigate security incidents from first alert to closure.
• Assist in ownership of health of security log flow, onboard new sources, and maintain parsing and normalization.
• Maintain CI/CD and automation behind the detection program, including GitHub Actions and SIEM integrations.

Skills

Python

KQL

Git

CI/CD

Threat hunting

Incident response

Detection engineering

Cloud security

MITRE ATT&CK

Adversary emulation

Tools

Cribl Stream

Sigma rules

Atomic Red Team

Caldera

GitHub Actions

Job description

Cribl is seeking a senior security engineer to join Team Alpine, focusing on detection engineering, threat hunting, and incident response. You’ll design detections as code (KQL) and map detections to MITRE ATT&CK, while owning log pipelines with Cribl Stream.

Collaborate with Product Security, IT, and Legal, lead IR rotations for 6–12 months, and contribute to CI/CD, runbooks, and detection documentation. You will mentor teammates and drive robust security operations.