Threat Detection Engineering Lead (Detection-as-Code)

Cribl; Bismarck (ND); Remote; USD 120,000 - 160,000; Full time

Benefits offered by this job

Health insurance, dental, vision

Paid holidays & PTO

Fertility treatment benefit

401(k) and equity

Generous leave policies

Job summary

Cribl is seeking a senior security engineer to join the internal security team, Team Alpine, focusing on detection engineering, threat hunting, and incident response. You will design detections as code, map to MITRE ATT&CK, tune rule quality, and participate in IR rotations while building out scalable detection pipelines.

You’ll work with Python, KQL, and Git-based workflows, contributing to CI/CD, SDLC, and SIEM integrations. A remote‑first culture with global collaboration awaits.

Qualifications

• 5+ years in security operations with hands‑on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python and Git-based CI/CD experience.
• Strong KQL skills for writing detection queries.
• Experience investigating incidents in cloud, SaaS, and identity providers.
• Hands-on experience with log pipelines and data ingestion.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow with CI/CD.
• Plan and run threat hunts across cloud, SaaS, identity, and infrastructure telemetry.
• Lead IR rotation for 6–12 months; write runbooks and improve visibility across detections.
• Own health of security log flow and data pipelines; maintain parsing and normalization.
• Mentor teammates; collaborate with IT, Infra, Engineering, and GRC to close visibility gaps.

Skills

Python

Git

KQL

Threat hunting

MITRE ATT&CK

Tools

Cribl Stream

SIEM

GitHub Actions

Sigma

Atomic Red Team

Caldera

Job description

Cribl is seeking a senior security engineer to join the internal security team, Team Alpine, focusing on detection engineering, threat hunting, and incident response. You will design detections as code, map to MITRE ATT&CK, tune rule quality, and participate in IR rotations while building out scalable detection pipelines.

You’ll work with Python, KQL, and Git-based workflows, contributing to CI/CD, SDLC, and SIEM integrations. A remote‑first culture with global collaboration awaits.