Threat Detection Engineer

Cribl builds telemetry infrastructure for some of the world's biggest security teams. We're remote-first and grounded in a simple idea: software is a people business.

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Map detections to MITRE ATT&CK, find coverage gaps, and decide where to invest next.
• Review new community and vendor rule releases, such as Sigma.
• Cut alert noise by tuning, retiring rules that no longer earn their place.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry.
• Use adversary emulation to generate test events.
• Turn hunt findings into durable detections, documentation, and backlog items.
• Take part in the IR rotation: triage, scope, contain, and investigate security incidents.
• Run retrospectives and turn the lessons into new detections.
• Write and maintain runbooks.
• Assist in ownership of the health of security log flow.
• Build and maintain data pipelines with Cribl Stream.
• Maintain the CI/CD and automation behind the detection program.
• Work independently, and design the processes, standards, and tools.
• Mentor teammates through code review, pairing, and clear documentation.
• Work with IT, Infrastructure, Engineering, and GRC to close visibility gaps.

• [5+] years in security operations, with significant hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK.
• Experience investigating incidents in cloud (AWS, GCP, and/or Azure), SaaS, and identity providers.
• Hands-on experience with log pipelines.
• The judgment to separate a real signal from noise.
• Clear writing for both technical and non-technical audiences.
• Uses AI as a routine part of engineering work.
• Bonus: experience with Cribl Stream or other telemetry pipeline tools.
• Bonus: experience with Sigma rules, adversary emulation (Atomic Red Team, Caldera, or similar), or purple teaming.
• Bonus: experience building agentic or AI-assisted workflows for security operations.
• Bonus: certifications such as GCIH, GCDA, or equivalent experience.

• Remote - United States.
• This position will require stand-by, on-call, or off-hours duties.
• The salary for this role is dependent on geographic location and will be based on the individual candidate's job-related knowledge, skills, and experience.
• In addition to a competitive salary, Cribl also offers a generous benefits package.