Cribl
Senior Threat Detection Engineer
$108K–$169K
Remote - United States +1 · Remote · Senior · Full-time · Posted Oct 7, 2026
- Location
- Remote - United States
US - California - Experience
- 5+ years in security operations; significant hands-on time in detection engineering, threat hunting, or incident response.
About the job
Protect Cribl by building and operating detection-as-code, threat-hunting, incident-response, and security telemetry pipeline capabilities.
What you'll do
- Design, test, tune, and deploy detections as code; map coverage to MITRE ATT&CK and manage detection quality.
- Conduct hypothesis-driven threat hunts and incident investigations, turning findings into detections, runbooks, and visibility improvements.
- Maintain security log pipelines and detection automation, including Cribl Stream, GitHub Actions, SIEM integrations, and AI-assisted reviews.
What they ask for
- 5+ years in security operations, with significant hands-on experience in detection engineering, threat hunting, or incident response.
- Experience writing and maintaining detections as code in a modern SIEM; strong KQL skills.
- Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
- Experience investigating incidents in cloud, SaaS, and identity providers, plus hands-on log pipeline experience.
Nice to have
- Experience with Cribl Stream or other telemetry pipeline tools; Sigma rules, adversary emulation, or purple teaming.
- Experience building agentic or AI-assisted security operations workflows; certifications such as GCIH or GCDA, or equivalent experience.
Pay
$108,000 — $169,000 USD (base salary)
Tools
KQL, Python, Git, CI/CD, MITRE ATT&CK, AWS, GCP, Azure
AI focus
Use AI routinely in engineering work; AI agents support detection coverage-gap analysis and pull-request review. Experience building agentic or AI-assisted security operations workflows is a bonus.
Model-written summary · the original posting is authoritative