Staff Threat Protection Engineer

Cribl; California; Hybrid; USD 130,000 - 190,000; Full time

Benefits offered by this job

Remote work

Hybrid work environment

Job summary

Cribl is seeking a staff-level investigator who blends insider threat investigations, digital/hardware forensics, and executive protection. This hybrid role centers on senior-level investigations, briefing executives, and maturing security programs.

You will lead complex cases, walk into forensic exams, and support principal travel security, reporting to a small high-trust team with strong discretion.

Qualifications

• Minimum 7+ years across insider threat investigations, digital/hardware forensics, and executive protection or equivalent.
• Lead investigations from detection to closure with scoping, evidence collection, and remediation recommendations.
• Experience presenting findings to senior leadership with discretion and privacy.
• Hands-on forensic skills with standard tooling and hardware-level techniques.

Responsibilities

• Lead insider risk investigations end-to-end, including interviews and remediation recommendations.
• Conduct forensic acquisitions and analysis of laptops, mobile devices, and network artifacts.
• Plan and execute executive protection during travel and events, coordinating with assistants.

Skills

Insider threat investigations

Digital forensics

Hardware forensics

Executive protection

Interviews

Documentation

Stakeholder communication

Discretion/confidentiality

Education

IACIS CFCE

EnCE

GCFE

Tools

EnCase

FTK

Cellebrite

X-Ways

Job description

Why You’ll Love This Role

We’re looking for a staff-level investigator who operates at the intersection of insider threat, digital/hardware forensics, and executive protection. This is a hybrid role for someone who has led complex insider risk cases end-to-end, can walk into a forensic exam and brief executives in the same week, and is equally comfortable planning a principal’s travel security as they are imaging a hard drive for a legal hold. You’ll be the senior technical and investigative resource on a small, high-trust team, and you’ll help mature our insider risk, forensics, and physical security programs.

As An Active Member Of Our Team, You Will…

Insider Threat & Investigations

• Lead insider risk investigations from initial detection through closure, including scoping, evidence collection, interviews, findings, and remediation recommendations

• Partner closely with HR, Legal, and Employee Relations to ensure investigations are conducted defensibly, confidentially, and in compliance with employment law and privacy requirements

• Build and mature insider risk program components: detection use cases, escalation criteria, case management workflows, and cross-functional playbooks

• Brief sensitive findings to senior stakeholders (Legal, HR, executive leadership) with appropriate discretion and documentation

Digital & Hardware Forensics

• Conduct forensic acquisition and analysis of laptops, mobile devices, removable media, and network artifacts in support of investigations

• Maintain chain of custody and produce forensically sound, litigation-ready documentation

• Perform hardware-level forensics (disk imaging, device teardown/analysis, embedded storage) in addition to standard digital forensics

• Apply and maintain relevant certifications (IACIS CFCE or equivalent; EnCE, GCFE, or similar strongly preferred)

Physical Security & Executive Protection

• Provide executive protection coverage for principals during domestic and international travel and at company events and conferences.

• Lead security planning for company conferences and events

• Conduct pre-travel intelligence and risk assessments (geopolitical, environmental, venue-specific) to inform protective planning

• Coordinate directly with executive assistants on itineraries, logistics, and advance planning to ensure protection is seamless and low-friction

• Support physical security assessments of office locations, facilities and events, identifying and mitigating potential vulnerabilities and additional ways to secure them

If You’ve Got It - We Want It

• 7+ years of experience across insider threat investigations, digital/hardware forensics, and physical/executive protection (or a combination demonstrating equivalent depth)
• Demonstrated experience serving as lead investigator on insider risk cases involving sensitive, high-stakes, or legally exposed matters
• Working knowledge of employment law, HR investigation standards, and confidentiality requirements as they apply to internal investigations
• Hands-on forensic skills with standard tooling (e.g., EnCase, FTK, Cellebrite, X-Ways) and hardware-level forensic techniques
• Active or recent certification through IACIS (CFCE) or comparable digital forensics credentialing body
• Prior experience in executive protection, including travel risk assessment/intelligence gathering and direct coordination with executive support staff
• Excellent judgment and discretion; ability to hold confidentiality under pressure and manage competing stakeholder interests
• Strong written and verbal communication skills, including the ability to translate technical forensic findings for non-technical, legal, and executive audiences
• Willingness and ability to travel on short notice, including internationally

Preferred

• Background in law enforcement, military, or federal investigative service
• Experience building or scaling an insider risk program from an early or immature state
• Clearance at the TS level preferred, Secret will be reviewed
• Familiarity with UEBA/DLP tooling and insider threat detection platforms

#LI-KJ1
#LI-Remote