Sr. CRIBL Engineer

Everforth, Inc.; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Everforth ECS is seeking a Senior Cribl Engineer to work remotely with federal and enterprise clients, focusing on Cribl Stream/Edge implementations and scalable data pipelines. You will optimize ingestion, routing, and enrichment to improve observability and security analytics while controlling costs.

The role demands hands-on leadership in Cribl deployment, automation, and integration with SIEMs and cloud platforms, plus collaboration with ECS teams to drive service delivery and knowledge

Qualifications

• Must hold current Cribl certifications such as CC Admin Stream/Edge.
• Extensive experience designing data pipelines and telemetry architectures.
• Proven ability to lead customer-facing engagements and translate requirements into scalable solutions.
• Strong Windows/Linux scripting and automation skills.

Responsibilities

• Lead design and implementation of Cribl solutions, including Stream and Edge.
• Architect data ingestion, routing, filtering, and enrichment across enterprise environments.
• Partner with customers to reduce SIEM and storage costs via data shaping and routing.
• Integrate Cribl with SIEMs, data lakes, and cloud analytics platforms.
• Create implementation guides and customer-facing documentation.

Skills

Cribl expertise

Data pipeline design

SIEM integration

Cloud platforms

Python Bash PowerShell

OpenTelemetry

Terraform CloudFormation

Docker Kubernetes

Travel willingness

Customer-facing engagements

Tools

Cribl Stream

Cribl Edge

Splunk

Elastic Stack

Job description

ECS is seeking a Senior Cribl Engineer to work remotely. Please Note: This position is contingent upon contract award.

We are seeking a highly skilled consultant with deep experience in Cribl and modern telemetry/data pipeline architectures to support enterprise customers in designing, optimizing, and operationalizing their data strategies. This role focuses on enabling organizations to gain control, visibility, and efficiency across their observability and security data environments by leveraging Cribl’s vendor-agnostic data processing and routing capabilities.

As a Senior Cribl Consultant, you will work directly with customers to implement scalable data pipelines, optimize data ingestion and routing, reduce telemetry costs, and improve performance across SIEM, observability, and analytics ecosystems. You will play a key role in translating complex technical requirements into scalable solutions that maximize data value while minimizing cost and operational complexity.

This role supports ECS’s Professional Services and Managed Cybersecurity Services programs, with a focus on Cribl solutions in conjunction with broader security and data platforms. You will work across technologies including SIEM, observability, and cloud data platforms—helping clients modernize their architectures and improve operational outcomes. This is a unique opportunity to work at the intersection of data engineering, security analytics, and cloud-scale telemetry management.

Responsibilities

• Lead design and implementation of Cribl solutions, including Stream, Edge, and related data pipeline components
• Architect and optimize data ingestion, routing, filtering, and enrichment strategies across enterprise environments
• Partner with customers to reduce SIEM and storage costs through intelligent data shaping and routing
• Integrate Cribl with downstream platforms such as SIEMs, data lakes, observability tools, and cloud analytics environments
• Conduct customer discovery sessions, translating business and technical requirements into scalable architectures
• Develop and implement best practices for telemetry pipelines, data governance, and observability strategies
• Provide hands-on support for deployment, tuning, troubleshooting, and performance optimization
• Collaborate with internal ECS teams to support delivery, managed services transition, and ongoing optimization efforts
• Create customer-facing documentation, architecture diagrams, and implementation guides
• Serve as a trusted advisor to customers, driving adoption, maturity, and long-term value realization
• Hands-on experience implementing, administering, and optimizing Cribl Stream, Cribl Edge, or related telemetry/data pipeline technologies
• Strong experience with log and telemetry pipelines, data routing, transformation, filtering, enrichment, and ingestion optimization
• Experience integrating with SIEM, observability, security analytics, and cloud data platforms
• Solid understanding of cloud environments (AWS, Azure, and GCP) and modern data architectures
• Experience with scripting and automation technologies such as Python, Bash, or PowerShell
• Demonstrated ability to troubleshoot and resolve complex data pipeline, telemetry, and observability issues
• Experience leading customer-facing professional services engagements, including requirements gathering, architecture workshops, implementation services, and knowledge transfer activities
• Demonstrated ability to administer and configure Cribl Stream and/or Cribl Edge in enterprise environments
• Strong communication and presentation skills with the ability to engage both technical and executive stakeholders
• Able and willing to support domestic and international travel to customer sites or ECS offices as required
• Possess and maintain a valid U.S. Passport
• Must possess at least one current Cribl certification, such as:
• CC Admin - Stream
• CC Admin - Edge

Desired Skills

• Must have a Secret at minimum
• Cribl Certified Service Consultant (CCSC) certification strongly preferred
• Cribl CC Admin - Stream Certification
• Cribl CC Admin - Edge Certification
• Hands-on experience with advanced Cribl capabilities, including routing rules, replay, filtering, parsing, enrichment, and pipeline performance optimization
• Experience delivering customer-facing Cribl professional services engagements, including deployment, migration, operationalization, and managed services transition activities
• Experience with Cribl Search and Cribl Lake
• Familiarity with OpenTelemetry (OTel) frameworks and telemetry collection architectures
• Experience integrating Cribl with Splunk Enterprise, Splunk Cloud, ES, and ITSI
• Experience integrating Cribl with the Elastic Stack (Elasticsearch, Kibana, Elastic Security)
• Experience implementing or integrating with Palo Alto Cortex XDR
• Experience implementing or integrating with Cortex XSIAM
• Experience implementing or integrating with Cortex XSOAR
• Familiarity with Cortex Data Lake
• Experience integrating Cribl with Snowflake for analytics and data warehousing use cases
• Experience integrating Cribl with Databricks for large-scale data processing, AI/ML, and lakehouse architectures
• Familiarity with modern data lake and lakehouse architectures
• Experience working with Apache Kafka, AWS Kinesis, Apache Pulsar, or similar streaming platforms
• Understanding of event-driven architectures and large-scale telemetry streaming patterns
• Experience deploying and managing solutions in AWS, Azure, and GCP environments
• Familiarity with Infrastructure-as-Code tools such as Terraform or CloudFormation
• Experience with containerization technologies including Docker and Kubernetes
• Experience supporting Federal, DoD, IC, DHS, or civilian government customers
• Experience implementing telemetry, observability, or SIEM cost optimization strategies in large-scale enterprise environments
• Experience migrating or modernizing telemetry platforms from Splunk, Elastic, QRadar, ArcSight, or similar technologies
• Experience transitioning solutions from implementation into managed services or steady-state operations

ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.

Everforth ECS is the federal segment of Everforth, a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies. Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.

• Attracting and developing top talent and high-performing teams
• Fostering a culture that is engaging, accountable, and mission-driven

Meet the challenge. Make a difference with Everforth ECS!