Senior Security Operations Engineer

Position Overview

Cribl is a rapidly growing, remote-first company that provides the data engine for IT and Security. We are seeking collaborative, curious, and motivated team members who are passionate about putting customers first. The Senior Security Operations Engineer will be a pivotal member of Cribl’s Information Security team, responsible for strengthening our security posture through robust security operations and advanced threat detection. This role involves leading security incident management, triage, and investigations, and developing innovative solutions to remediate and prevent future attacks. A key aspect will be designing, implementing, and optimizing detection logic to identify sophisticated threats. You will partner closely with Product Security, IT, and Legal teams, reporting to the Chief Information Security Officer.

Responsibilities

• Monitoring security events and alerting via our security tooling including MSSP, SIEM, AI, and CSPM tooling to identify and triage potential threats.
• Developing, implementing, and maintaining high-fidelity detection rules and alerts within SIEM and other security platforms (e.g., EDR, Cloud Security tools) based on threat intelligence, MITRE ATT&CK framework, and identified risks.
• Conducting continuous tuning and optimization of existing detection logic to reduce false positives and improve detection efficacy.
• Responding to issues identified by Cribl employees.
• Acting as a security incident response lead, including leveraging and improving detection capabilities during investigations.
• Building, enhancing, and managing security playbooks, incorporating detection engineering best practices.
• Conducting security assessments of corporate assets through vulnerability testing and threat hunts, and purple team activities, with a focus on identifying detection gaps and opportunities.
• Performing both internal and external security reviews of corporate properties (e.g., the corporate website and enterprise applications).
• Leading security incident response tabletop exercises.
• Continuing to evolve and champion the use of Cribl products in our security tech stack to enhance detection, analysis, and response capabilities.
• Collaborating with threat intelligence teams to integrate new indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) into detection strategies.

Requirements

• Knowledge of and experience with modern security principles (e.g., security data lakes, detections as code, EDR, zero trust networking, and other security tooling).
• Demonstrated experience with incident response and management.
• Proven experience in developing, deploying, and maintaining detection rules (e.g., Sigma, YARA, Splunk SPL, KQL) across various security platforms.
• Strong understanding of common attack frameworks (e.g., MITRE ATT&CK) and how to map detections to TTPs.
• Understanding of authentication and authorization schemes such as SAML, OpenID, OAuth2, and SCIM.
• Experience scripting/coding in at least one of the following languages: Python, NodeJS, Ruby, Bash.
• Excellent communication skills and ability to communicate ideas to technical and non-technical audiences.
• Comfortable with ambiguity, strong analytical acumen, self-motivated, and able to work cross-functionally.

Company Information

Cribl is a serious company that doesn’t take itself too seriously. We are looking for people who love to get stuff done and laugh a bit along the way. As a remote-first company, we believe in empowering our employees to do their best work, wherever they are. Many of the biggest names in the most demanding industries trust Cribl to solve their most pressing data needs. Join the herd and unlock your opportunity.