{"id":2118902,"url":"https://alion.io/job/cribl-senior-threat-detection-engineer-2","title":"Senior Threat Detection Engineer","company":{"id":621,"name":"Cribl","domain":"cribl.io","url":"https://alion.io/company/cribl","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":75,"open_postings":8,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":50,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":108000,"max":169000,"currency":"USD","period":"year","gross":null,"usd_annual":169000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitOps","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-10-07T16:10:33Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-10-23T08:09:10Z","board_verified":true,"closed_at":null,"days_open":15,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":15},"description":"Join the company that’s building the telemetry infrastructure for the AI era. At Cribl, we partner with IT and Security teams at many of the world’s biggest enterprises, including half of the Fortune 100, to bridge the gap between AI ambition and infrastructure reality. As the AI Platform for Telemetry, we give customers the choice, control, and flexibility to manage and analyze telemetry for both humans and agents, so they can build what’s next.\nWe’re one of the fastest-growing private companies and a leading player in a massive, fast-moving market. With a global workforce, we’re remote-first and grounded in a simple idea: software is a people business. Cribl is the place where curious, collaborative people can do their best work, grow fast, and bring their full selves to the herd.\nWhy You’ll Love This Role\nCribl builds telemetry infrastructure for some of the world's biggest security teams. Now we're looking for someone to protect Cribl itself. You'll join Cribl's internal security team, Team Alpine, to run detection as code. Our team runs a detection as code pipeline where rules live in Git, are tested in CI, and deploy to our SIEM automatically. AI agents watch for coverage gaps and help review every change.\nThis is a hands-on senior role covering the whole detection lifecycle. You'll hunt for threats nobody has written a rule for yet, turn what you find into detections, and keep the log pipelines behind those detections healthy. For the first [6-12] months you'll also be a core part of our incident response rotation while we build out that function. You'll lead investigations, and what you learn will feed straight back into the detections. \nIf you want your work to show up in production quickly, and you like owning the data as well as the rules, this role is for you. You will partner closely with Product Security, IT, and Legal teams, and report to the Sr. Director, Security Engineering and Operations under the CISO.\n\nAs An Active Member Of Our Team, You Will…\nDetection Engineering\nDesign, build, test, and tune detections as code (KQL) through a GitOps workflow: issue, pull request, unit and back-testing, then automated deployment\nMap detections to MITRE ATT&CK, find coverage gaps, and decide where to invest next based on our threat model\nReview new community and vendor rule releases, such as Sigma, and decide what to adopt, adapt, or skip\nCut alert noise by tuning, retiring rules that no longer earn their place, and tracking detection quality metrics\nThreat Hunting\nPlan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry\nUse adversary emulation to generate test events for detections that have nothing to fire on yet\nTurn hunt findings into durable detections, documentation, and backlog items\nIncident Response (initial [6-12] months)\nTake part in the IR rotation: triage, scope, contain, and investigate security incidents from first alert to closure\nRun retrospectives and turn the lessons into new detections, playbook updates, and fixes to visibility gaps\nWrite and maintain runbooks so others on the team can respond consistently\nDetection Infrastructure & Log Pipelines\nAssist in ownership of the health of security log flow: onboard new sources, maintain parsing and normalization, and monitor for dropped, delayed, or malformed data\nAssist and Build and maintain data pipelines with Cribl Stream to route, enrich, and reduce telemetry before it reaches the SIEM\nMaintain the CI/CD and automation behind the detection program, including GitHub Actions, SIEM API integrations, and AI-assisted gap analysis and PR review\nAcross the Team\nWork independently, and design the processes, standards, and tools that help others work well\nMentor teammates through code review, pairing, and clear documentation\nWork with IT, Infrastructure, Engineering, and GRC to close visibility gaps and improve detection coverage\nThis position will require stand-by, on-call, or off-hours duties\n\nIf You’ve Got It - We Want It\n[5+] years in security operations, with significant hands-on time in detection engineering, threat hunting, or incident response\nExperience writing and maintaining detections as code in a modern SIEM\nStrong Python skills and comfort with Git-based workflows, code review, and CI/CD\nStrong in KQL for writing detection queries\nWorking knowledge of MITRE ATT&CK and how to use it for coverage analysis, not just labeling\nExperience investigating incidents in cloud (AWS, GCP, and/or Azure), SaaS, and identity providers\nHands-on experience with log pipelines: getting data in, parsing it, and fixing it when it breaks\nThe judgment to separate a real signal from noise, and to know when to escalate\nClear writing for both technical and non-technical audiences: incident summaries, runbooks, detection docs\nUses AI as a routine part of engineering work, with concrete examples of how it has changed how you build, test, or investigate\nBonus: experience with Cribl Stream or other telemetry pipeline tools\nBonus: experience with Sigma rules, adversary emulation (Atomic Red Team, Caldera, or similar), or purple teaming\nBonus: experience building agentic or AI-assisted workflows for security operations\nBonus: certifications such as GCIH,GCDA, or equivalent experience\nThe salary for this role is dependent on geographic location and will be based on the individual candidate's job-related knowledge, skills, and experience.\nIn addition to base salary, for sales and some sales-adjacent roles, employees are eligible to earn incentive compensation (commission). For all other roles, employees are eligible to participate in the Cribl Corporate Bonus Program.\nIn addition to a competitive salary, Cribl also offers a generous benefits package which includes health, dental, vision, short-term disability, and life insurance, paid holidays and paid time off, a fertility treatment benefit, 401(k), and equity.\nBase Salary Range\n$108,000—$169,000 USD\nBring Your Whole Self\n\nDiversity drives innovation, enables better decisions to support our customers, and inspires change for the better. We’re building a culture where differences are valued and welcomed, and we work together to bring out the best in each other. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or any other applicable legally protected characteristics in the location in which the candidate is applying.\nInterested in joining the Cribl herd? Learn more about the smartest, funniest, most passionate goats you’ll ever meet at cribl.io/about-us.","description_format":"text","description_chars":6648,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Life insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Log Management & Analytics","Cybersecurity AI","Observability & APM"],"lifecycle":[{"event":"open","at":"2026-10-08T23:51:16Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 15 · green card filings: 4","filings_12m":15,"filings_prev_12m":11,"green_card_filings_12m":4,"median_offered_wage_usd":193816,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":2}],"liveness":{"score":87,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.872,"p_room":1,"age_days":15,"expected_fill_days":50,"reasons":["conf:2","velocity","win:early"],"computed_at":"2026-10-23T05:54:15Z"},"pay":{"stated_usd_annual":169000,"is_top_pay":true},"html_url":"https://alion.io/job/cribl-senior-threat-detection-engineer-2","json_url":"https://alion.io/job/cribl-senior-threat-detection-engineer-2.json","meta":{"generated_at":"2026-10-23T08:24:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13444,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":621},"rest":"https://alion.io/mcp/rest/get_company?id=621"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcribl-senior-threat-detection-engineer-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcribl-senior-threat-detection-engineer-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcribl-senior-threat-detection-engineer-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cribl-senior-threat-detection-engineer-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcribl-senior-threat-detection-engineer-2"}]}