Senior Threat Detection Engineer

Join Cribl, a leading telemetry infrastructure company, as a Senior Threat Detection Engineer. In this hands-on role, you'll be responsible for the entire detection lifecycle, from hunting for threats to turning findings into durable detections. You'll also be a core part of the incident response rotation and will work closely with various teams to improve detection coverage. This position offers a comprehensive benefits package, including medical, dental, and vision insurance, disability and income protection, mental health care, retirement plans, family planning benefits, generous time off, and remote office perks.

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow, and map detections to MITRE ATT&CK.
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry, and turn hunt findings into durable detections.
• Take part in the incident response rotation, triage, scope, contain, and investigate security incidents from first alert to closure.

• Bonus: certifications such as GCIH,GCDA, or equivalent experience
• Uses AI as a routine part of engineering work, with concrete examples of how it has changed how you build, test, or investigate
• Experience investigating incidents in cloud (AWS, GCP, and/or Azure), SaaS, and identity providers
• Clear writing for both technical and non-technical audiences: incident summaries, runbooks, detection docs
• The judgment to separate a real signal from noise, and to know when to escalate
• Strong in KQL for writing detection queries
• Bonus: experience building agentic or AI-assisted workflows for security operations
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD
• [5+] years in security operations, with significant hands-on time in detection engineering, threat hunting, or incident response
• Experience writing and maintaining detections as code in a modern SIEM
• Bonus: experience with Sigma rules, adversary emulation (Atomic Red Team, Caldera, or similar), or purple teaming
• Bonus: experience with Cribl Stream or other telemetry pipeline tools
• Hands-on experience with log pipelines: getting data in, parsing it, and fixing it when it breaks
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis, not just labeling