Senior Security Operations Engineer, Cribl
Data engine for IT & security
Be an early applicant
Data engine for IT & security
501-1000 employees
Be an early applicant
501-1000 employees
Company mission
To make observability viable for any organization, giving their customers visibility and control while maximizing value from existing tools, with pricing that is accessible for all.
Role
Who you are
- Knowledge of, and experience in, working with modern security principles e.g. security data lakes, detections as code, EDR, zero trust networking, and other security tooling, as well as demonstrated experience with incident response and management
- Proven experience in developing, deploying, and maintaining detection rules (e.g., Sigma, YARA, Splunk SPL, KQL) across various security platforms
- Strong understanding of common attack frameworks (e.g., MITRE ATT&CK) and how to map detections to TTPs
- Understanding of authentication and authorization schemes such as SAML, OpenID, OAuth2, and SCIM
- Experience scripting/coding in at least one of the following languages: Python, NodeJS, Ruby, Bash
- Be the go-to technical subject matter expert on security, compliance, and assurance topics
- Excellent communication skills and ability to communicate ideas to technical and non-technical audiences
- Comfortable with ambiguity, have a strong analytical acumen, self-motivated, able to work cross functionally
- Experience with SIEM platforms like Panther is a plus and its detection capabilities
- Familiarity with Wiz and cloud native security tooling for detection in AWS, Azure, or GCP
- Relevant certifications in cloud security or incident response (e.g., SANS GIAC certifications)
What the job involves
- The Senior Security Operations Engineer will be a pivotal member of Cribl’s Information Security team, primarily responsible for strengthening our security posture through robust security operations and advanced threat detection
- You will lead security incident management, triage, and investigations, and be instrumental in developing innovative solutions to remediate current threats and proactively prevent future attacks
- A key aspect of this role will be designing, implementing, and optimizing detection logic to identify sophisticated threats across our environment
- You will partner closely with Product Security, IT, and Legal teams, and report to the Chief Information Security Officer
- Monitoring security events and alerting via our security tooling including MSSP, SIEM, AI, and CSPM tooling to identify and triage potential threats
- Developing, implementing, and maintaining high-fidelity detection rules and alerts within SIEM and other security platforms (e.g., EDR, Cloud Security tools) based on threat intelligence, MITRE ATT&CK framework, and identified risks
- Conducting continuous tuning and optimization of existing detection logic to reduce false positives and improve detection efficacy
- Responding to issues identified by our Cribl employees
- Acting as a security incident response lead, including leveraging and improving detection capabilities during investigations
- Building, enhancing, and managing security playbooks, incorporating detection engineering best practices
- Conducting security assessments of corporate assets through vulnerability testing and threat hunts, and purple team activities, with a focus on identifying detection gaps and opportunities
- Performing both internal and external security reviews of corporate properties e.g. the corporate website and enterprise applications
- Leading security incident response tabletop exercises
- Continuing to evolve and champion the use of Cribl products in our security tech stack to enhance detection, analysis, and response capabilities
- Collaborating with threat intelligence teams to integrate new indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) into detection strategies
Our take
In a bid to simplify big data analytics, Cribl offers a data observability pipeline which allows users to reduce low value data, improve routing and gain more data context on one interface.
As companies now collect more and more data from frequently scattered sources, its useability and reliability comes into question. By offering an observability service, Cribl allows users to maintain the health of their data systems by monitoring, tracking and troubleshooting issues.
Cribl's main challenge will be competing with the likes of Observe and Edge Delta. However, Cribl has raised impressive funds that should accelerate its transition from a limited tool vendor to a fully-fledged observability suite. The company also boasts surpassing $100 million in annual recurring revenue, having grown this from $1 million in less than four years.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
32% employee growth in 12 months
Company
Funding (last 2 of 5 rounds)
Aug 2024
$200m
SERIES E
May 2022
$150m
SERIES D
Total funding: $592.5m
Company benefits
- Stock Options
- Medical, dental, and vision insurance
- Flexible spending account (FSA)
- Parental Leave
- Professional Development and Career Growth
- Generous Vacation and Holiday Policy, including 2 Floating Holidays for holidays you observe
- Employee Resource Groups that reflect our values driven company culture
- Remote-first
Company HQ
The East Cut, San Francisco, CA
Leadership
Clint Sharp
(CEO)They were Chief Software Architect at Prophetline from 1999 to 2002, and the founder of Aggregate Technology Solutions. They were also Senior Director of Product Management at Splunk.
Dritan Bitincka
(Products)They worked as Computer Sciences Laboratory Director at Farleigh Dickinson University. Joined Splunk as Principal Architect in 2011.
Ledion Bitincka
(CTO)They acted as a Scientific Consultant at Harvard University before joining Looksmart as a Software Engineer in 2006. They founded Triangulus Communications and were Splunk's Advanced Development Architect.
Share this job
View 18 more jobs at Cribl