Senior Threat Detection & IR Engineer (Detection as Code)

Cribl; Boise (ID); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health, dental, vision

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k) and equity

Job summary

Cribl is seeking a senior security engineer to join Team Alpine, driving detections as code, threat hunting, and incident response. You will own detection pipelines, contribute to log health, and collaborate with IT, Legal, and Product Security. This remote-first role emphasizes hands-on engineering, CI/CD, and rapid production impact.

You will work across cloud, SaaS, and identity telemetry, mentoring teammates and shaping detection strategy in a fast-moving security program at Cribl.

Qualifications

• 5+ years in security operations with hands-on detection, hunting, or IR.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL and working knowledge of MITRE ATT&CK for coverage analysis.
• Experience investigating incidents in cloud, SaaS, and identity providers.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Plan and run hypothesis-driven threat hunts across cloud, SaaS, identity, and endpoints.
• Lead IR rotation: triage, scope, contain, and investigate incidents from first alert to closure.
• Own health of security log flow: onboarding, parsing, normalization, and monitoring data quality.
• Mentor teammates through code review, pairing, and clear documentation.

Skills

Python

KQL

Detections

Threat hunting

Incident response

SIEM

Tools

Cribl Stream

Sigma rules

GitHub Actions

Job description

Cribl is seeking a senior security engineer to join Team Alpine, driving detections as code, threat hunting, and incident response. You will own detection pipelines, contribute to log health, and collaborate with IT, Legal, and Product Security. This remote-first role emphasizes hands-on engineering, CI/CD, and rapid production impact.

You will work across cloud, SaaS, and identity telemetry, mentoring teammates and shaping detection strategy in a fast-moving security program at Cribl.