Job Description

• 10+ years of experience in logging, observability, or SIEM engineering.
• 5+ years architecting enterprise scale log/telemetry pipelines.
• 3+ years hands‑on with Cribl Stream and Cribl Edge in production environments.
• Demonstrated success operating and scaling pipelines at 5–10+ TB/day.
• Expert-level experience with Splunk forwarding/ingestion, source type management, and indexing practices.
• Strong Linux fundamentals; scripting expertise (Python/Bash); Git; automation (Ansible/Terraform).
• Strong understanding of transport protocols (HTTP, TCP, TLS/MTLS), Kafka, S3/object storage.
• Experience designing secure data flows, including encryption, RBAC, secrets management, and compliance controls.
• Demonstrated ability to mentor senior engineers and lead technical decision making.
• Certified Cribl Certified Engineer (CCOE) or equivalent Cribl product expertise.
• Ability to obtain a DoD 8570 IAT Level III Certification such as SecurityX (formerly CASP+), CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP certification within 30 days of start date.
• Ability to obtain a DoD 8570 Cybersecurity Service Provider - Infrastructure Support Certification (CSSP-IS), including CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND Certification, within 30 days of start date.

• Expertise creating and maintaining Cribl Packs and reusable pipelines.
• Experience with cloud telemetry (AWS, Azure, hybrid) and cross‑domain data movement patterns.
• Familiarity with NIST / CIS control frameworks and secure engineering practices.
• Experience building observability frameworks for large distributed systems.
• Vendor engagement experience (Cribl PS, product teams, troubleshooting escalations).