Note: The job is a remote job and is open to candidates in USA. Cribl is hiring a Senior Staff Engineer for its Security Products team to build next-generation AI SOC capabilities. The role focuses on post-detection autonomous investigation, evidence synthesis, and response orchestration, while establishing reliable and safe AI systems and guiding engineering strategy.
Responsibilities
- Architect post-detection workflows, including autonomous triage, agentic investigation, evidence synthesis, and containment orchestration
- Build production-grade reasoning systems using LLMs, embeddings, and context graphs to formulate hypotheses, gather evidence, and deliver explainable verdicts
- Work closely with Cribl Detect to ingest high-fidelity detection signals and trigger automated investigations and responses
- Explore agentic paradigms, multi-agent frameworks, and natural language SOC interfaces, rapidly validating concepts through functional prototypes
- Write core abstractions, design agent communication protocols, review critical code, and establish strict benchmarks for model accuracy, latency, and system reliability
- Build safe execution frameworks offering transparent reasoning trails, clear chains of custody, and human-on-the-loop controls
- Partner tightly with product managers, security researchers, and stakeholders to translate ambiguous ideas into clear technical strategies and executable plans
- Guide engineering talent and represent Cribl’s AI SOC vision internally and externally via architecture reviews, technical blogs, and discussions
- This position will require stand-by, on-call, or off-hours duties
Skills
- Bachelor's degree in Computer Science, Electrical Engineering, or equivalent experience
- 12+ years of experience building scale production software
- Demonstrated experience leading engineering initiatives and directly building AI SOC, SOAR, or post-detection automation capabilities at scale (e.g., automated triage, multi-agent investigation systems, or response platforms)
- Deep, practical experience building and deploying production-grade AI systems—utilizing LLM orchestration frameworks, agent swarms, vector databases/embeddings, dynamic tool calling, and RAG architectures in enterprise software
- Track record of designing and operating scalable, low-latency distributed systems capable of handling asynchronous event processing and complex, multi-system workflow state machines
- Deep understanding of the security analyst workflow and frameworks like MITRE ATT&CK
- Strong experience designing robust, extensible API frameworks to interface with third-party security platforms (EDR, Identity Providers, Cloud Infrastructure, SIEM/SOAR)
- Proven capability to lead ambiguous, highly autonomous initiatives from abstract concept to production rollout
- High ownership mindset with a bias toward quality, performance, and simplicity
- Clear, effective communicator—able to explain complex technical ideas to engineers, partners, and customers in remote, distributed teams
- Direct experience building autonomous agent frameworks for security context
- Experience with JavaScript/TypeScript, NodeJS, or Go/Python in enterprise systems
- Background in graph databases or contextual graph models used to represent identities, endpoints, and threat histories
- Master's
Benefits
- Employees in roles other than sales and sales-adjacent roles are eligible to participate in the Cribl Corporate Bonus Program.
- Health insurance
- Dental insurance
- Vision insurance
- Short-term disability insurance
- Life insurance
- Paid holidays
- Paid time off
- A fertility treatment benefit
- 401(k)
- Equity
- Fully remote role
Company Overview
Company H1B Sponsorship