Senior Threat Detection Engineer

📋 Description Design, build, test, and tune detections as code (KQL) through a GitOps workflow: issue, pull Map detections to MITRE ATT&CK, find coverage gaps, and decide where to invest next based on Review new community and vendor rule releases, such as Sigma, and decide what to adopt, adapt, or Cut alert noise by tuning, retiring rules that no longer earn their place, and tracking detection Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate Use adversary emulation to generate test events for detections that have nothing to fire on yet 🎯 Requirements 5+ years in security operations, with significant hands-on time in detection engineering, threat Experience writing and maintaining detections as code in a modern SIEM Strong Python skills and comfort with Git-based workflows, code review, and CI/CD Strong in KQL for writing detection queries Working knowledge of MITRE ATT&CK and how to use it for coverage analysis, not just labeling Experience investigating incidents in cloud (AWS, GCP, and/or Azure), SaaS, and identity providers 🎁 Benefits Health, dental, vision, short-term disability, and life insurance Paid holidays and paid time off Fertility treatment benefit 401(k) Equity Eligible to participate in the Cribl Corporate Bonus Program