Senior Threat Detection & Incident Response Engineer

Openkrill; United States; Remote; USD 108,000 - 169,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is building telemetry infrastructure for the AI era. This hands-on senior role spans detection engineering, threat hunting, and incident response to protect Cribl’s own systems and customers. You will design detections as code, tune rules, and drive the CI/CD pipeline with GitHub Actions and SIEM integrations.

You'll collaborate with Product Security, IT, and Legal, own detection health, and mentor teammates while standing by for on-call duties during a 6–12 month IR rotation.

Qualifications

• 5+ years in security operations with hands-on time in detection engineering, threat hunting, or incident response
• Experience writing and maintaining detections as code in a modern SIEM
• Strong Python skills and familiarity with Git-based workflows, code review, and CI/CD
• Strong in KQL and MITRE ATT&CK mapping for coverage analysis
• Experience investigating incidents in cloud, SaaS, and identity providers
• Hands-on experience with log pipelines and data health

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow
• Map detections to MITRE ATT&CK and identify coverage gaps
• Review new community and vendor rule releases (Sigma) and decide adoption
• Cut alert noise by tuning and retiring rules that underperform
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoints
• Turn hunt findings into durable detections, docs, and backlog items
• Participate in IR rotation for 6–12 months and drive post-incident learnings
• Own health of security log flow and data pipelines with Cribl Stream
• Maintain CI/CD and automation behind the detection program
• Mentor teammates and write runbooks

Skills

Python

Git workflows

KQL

MITRE ATT&CK

Cloud platforms

CI/CD

Incident response

Threat hunting

Detections as code

SIEM

Education

Bachelor’s degree (security related)

Tools

Cribl Stream

Sigma

GitHub Actions

SIEM

Job description

Cribl is building telemetry infrastructure for the AI era. This hands-on senior role spans detection engineering, threat hunting, and incident response to protect Cribl’s own systems and customers. You will design detections as code, tune rules, and drive the CI/CD pipeline with GitHub Actions and SIEM integrations.

You'll collaborate with Product Security, IT, and Legal, own detection health, and mentor teammates while standing by for on-call duties during a 6–12 month IR rotation.