Staff Threat Protection Engineer

VulnU; United States; Hybrid; USD 128,000 - 200,000; Full time

Benefits offered by this job

Health, dental, vision

401(k) and equity

Paid holidays and PTO

Fertility treatment benefit

Job summary

Cribl is seeking a staff-level investigator to lead insider threat investigations, forensics, and executive protection. You will own complex cases end-to-end, coordinate with HR/Legal, and handle travel security planning for principals.

You will serve as the senior technical resource on a high-trust team, maturing insider risk and physical security programs. The role requires 7+ years across investigations, forensics, and protection, with hands-on tooling and international travel readiness.

Qualifications

• 7+ years of experience across insider threat investigations, digital forensics, and physical/executive protection.
• Lead investigator on insider risk cases involving high-stakes or legally exposed matters.
• Hands-on forensic skills with standard tooling and hardware-level techniques.
• Active or recent CFCE/CFCE-equivalent certifications preferred.

Responsibilities

• Lead insider risk investigations from detection through closure, including scoping, evidence collection, interviews, findings, and remediation recommendations.
• Partner with HR, Legal, and Employee Relations to ensure defensible investigations compliant with privacy laws.
• Develop and mature insider risk program components: detection use cases, escalation criteria, and workflows.
• Brief sensitive findings to senior stakeholders with discretion and documentation.
• Conduct forensic acquisitions of laptops, mobile devices, removable media, and network artifacts.

Skills

Insider threat investigations

Digital forensics

Executive protection

Security incident response

Executive communication

Education

IACIS CFCE or equivalent

EnCE

GCFE

Tools

EnCase

FTK

Cellebrite

X-Ways

Job description

Join the company that’s building the telemetry infrastructure for the AI era. At Cribl, we partner with IT and Security teams at many of the world’s biggest enterprises, including half of the Fortune 100, to bridge the gap between AI ambition and infrastructure reality. As the AI Platform for Telemetry, we give customers the choice, control, and flexibility to manage and analyze telemetry for both humans and agents, so they can build what’s next.We’re one of the fastest‐growing private companies and a leading player in a massive, fast‐moving market. With a global workforce, we’re remote‐first and grounded in a simple idea: software is a people business. Cribl is the place where curious, collaborative people can do their best work, grow fast, and bring their full selves to the herd.Why You’ll Love This RoleWe're looking for a staff-level investigator who operates at the intersection of insider threat, digital/hardware forensics, and executive protection. This is a hybrid role for someone who has led complex insider risk cases end-to-end, can walk into a forensic exam and brief executives in the same week, and is equally comfortable planning a principal's travel security as they are imaging a hard drive for a legal hold. You'll be the senior technical and investigative resource on a small, high-trust team, and you'll help mature our insider risk, forensics, and physical security programs.As An Active Member Of Our Team, You Will...Insider Threat InvestigationsLead insider risk investigations from initial detection through closure, including scoping, evidence collection, interviews, findings, and remediation recommendationsPartner closely with HR, Legal, and Employee Relations to ensure investigations are conducted defensibly, confidentially, and in compliance with employment law and privacy requirementsBuild and mature insider risk program components: detection use cases, escalation criteria, case management workflows, and cross-functional playbooksBrief sensitive findings to senior stakeholders (Legal, HR, executive leadership) with appropriate discretion and documentationDigital Hardware ForensicsConduct forensic acquisition and analysis of laptops, mobile devices, removable media, and network artifacts in support of investigationsMaintain chain of custody and produce forensically sound, litigation-ready documentationPerform hardware-level forensics (disk imaging, device teardown/analysis, embedded storage) in addition to standard digital forensicsApply and maintain relevant certifications (IACIS CFCE or equivalent; EnCE, GCFE, or similar strongly preferred)Physical Security Executive ProtectionProvide executive protection coverage for principals during domestic and international travel and at company events and conferences.Lead security planning for company conferences and eventsConduct pre-travel intelligence and risk assessments (geopolitical, environmental, venue-specific) to inform protective planningCoordinate directly with executive assistants on itineraries, logistics, and advance planning to ensure protection is seamless and low-frictionSupport physical security assessments of office locations, facilities and events, identifying and mitigating potential vulnerabilities and additional ways to secure themIf You’ve Got It - We Want It7+ years of experience across insider threat investigations, digital/hardware forensics, and physical/executive protection (or a combination demonstrating equivalent depth)Demonstrated experience serving as lead investigator on insider risk cases involving sensitive, high-stakes, or legally exposed mattersWorking knowledge of employment law, HR investigation standards, and confidentiality requirements as they apply to internal investigationsHands-on forensic skills with standard tooling (e.g., EnCase, FTK, Cellebrite, X-Ways) and hardware-level forensic techniquesActive or recent certification through IACIS (CFCE) or comparable digital forensics credentialing bodyPrior experience in executive protection, including travel risk assessment/intelligence gathering and direct coordination with executive support staffExcellent judgment and discretion; ability to hold confidentiality under pressure and manage competing stakeholder interestsStrong written and verbal communication skills, including the ability to translate technical forensic findings for non-technical, legal, and executive audiencesWillingness and ability to travel on short notice, including internationallyPreferredBackground in law enforcement, military, or federal investigative serviceExperience building or scaling an insider risk program from an early or immature stateClearance at the TS level preferred, Secret will be reviewedFamiliarity with UEBA/DLP tooling and insider threat detection platforms#LI-KJ1#LI-RemoteThe salary for this role is dependent on geographic location and will be based on the individual candidate's job-related knowledge, skills, and experience.In addition to base salary, for sales and some sales-adjacent roles, employees are eligible to earn incentive compensation (commission). For all other roles, employees are eligible to participate in the Cribl Corporate Bonus Program.In addition to a competitive salary, Cribl also offers a generous benefits package which includes health, dental, vision, short-term disability, and life insurance, paid holidays and paid time off, a fertility treatment benefit, 401(k), and equity.Base Salary Range$128,000 $200,000 USD