Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 6 days ago

Senior Cribl Pipeline Engineer / Security Data Engineer

TSG Risk Management7 open roles

Where
Charlotte, North Carolina, United States, Remote
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Cribl Pipeline Engineer / Security Data EngineerTSG Risk Management · Charlotte, North Carolina, United States, Remote

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on TSG Risk Management's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.9% of postings close within 7 days. Measured by our own scanner across the market. TSG Risk Management postings stay open a median of 12 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 13.9%7 days
  4. 22.4%14 days
  5. 38.1%30 days
  6. 59.0%60 days
This job: posted 6 days ago

TSG Risk Management median: 12 days open

The posting

Senior Cribl Pipeline Engineer / Security Data Engineer

Location: Charlotte, NC preferred. Candidates in New York City, Los Angeles, Southern California, or other locations may also be considered.

Work Model: Flexible hybrid or remote

Position Overview

We are seeking an experienced Senior Cribl Pipeline Engineer / Security Data Engineer to build, maintain, and optimize scalable data pipelines using Cribl LogStream/Stream.

This is a hands-on Cribl development role focused on using pipelines, packs, routes, functions, parsers, and field-level transformations to process and deliver enterprise data. The position is not primarily focused on backend infrastructure administration or simply monitoring whether data is flowing through the platform.

The ideal candidate will have substantial experience extracting and mapping fields, parsing and normalizing data, building reusable Cribl content, and routing information into Snowflake, Databricks, SIEM platforms, security analytics tools, or enterprise data lakes.

Experience working with security telemetry, OCSF mapping, Snowflake engineering, Splunk, AWS, and enterprise-scale data environments is strongly preferred. Candidates with strong Cribl experience from Splunk, observability, or infrastructure environments may also be considered if they have significant hands-on pipeline development experience.

Responsibilities

  • Develop, implement, and maintain enterprise data-processing pipelines using Cribl LogStream/Stream.
  • Build and maintain Cribl pipelines, packs, routes, functions, parsers, and reusable content.
  • Perform field extraction, parsing, filtering, masking, enrichment, normalization, and transformation.
  • Map security telemetry to OCSF or other standardized data schemas.
  • Build and support integrations between Cribl, Snowflake, Databricks, AWS, SIEM platforms, security tools, observability platforms, and enterprise data lakes.
  • Onboard and validate new data sources, including endpoint, firewall, identity, cloud, audit, application, infrastructure, and network telemetry.
  • Validate that transformed events contain the fields required by SIEM, detection engineering, threat-hunting, incident-response, and security-analytics teams.
  • Troubleshoot pipeline logic, malformed events, parsing failures, schema drift, field-mapping problems, dropped data, and data-quality issues.
  • Monitor pipeline performance and optimize routing, transformations, and data volumes.
  • Develop and support automated ingestion and source-onboarding workflows.
  • Create and maintain Snowflake databases, schemas, tables, views, streams, tasks, stored procedures, and data pipelines.
  • Collaborate with Security Operations, Detection Engineering, Data Engineering, Infrastructure, Analytics, and platform teams.
  • Document pipeline configurations, source-to-target mappings, operational procedures, and end-to-end data flows.

Required Qualifications

  • At least 3 years of substantial hands-on experience using Cribl LogStream/Stream to develop and maintain pipelines, packs, routes, functions, parsers, and field-level transformations.
  • Demonstrated experience with Cribl field extraction, parsing, enrichment, filtering, normalization, transformation, and routing.
  • Ability to clearly explain an end-to-end data flow, including the original source, processing performed in Cribl, and the downstream destination.
  • Experience building and supporting large-scale enterprise data-ingestion and processing pipelines.
  • Experience onboarding data into SIEM, security data lake, observability, analytics, or similar enterprise platforms.
  • Experience troubleshooting pipeline failures, malformed events, missing fields, schema changes, performance problems, and data-quality issues.
  • Experience with Python, JavaScript, or a similar scripting language for pipeline automation.
  • At least 2 years of hands-on Snowflake administration, architecture, or data-engineering experience in a large enterprise environment.
  • Experience designing or maintaining Snowflake databases, schemas, tables, views, streams, tasks, stored procedures, or ingestion pipelines.
  • Strong problem-solving, debugging, documentation, and communication skills.
  • Ability to work effectively with technical teams across security, data, infrastructure, operations, and analytics.

Preferred Qualifications

  • Experience mapping security data to OCSF.
  • Experience developing and maintaining custom Cribl packs.
  • Experience with security telemetry, security data normalization, or security analytics.
  • Experience with Splunk, including Splunk Enterprise or Splunk Enterprise Security.
  • Experience with SIEM architecture, SIEM migrations, or security-data onboarding.
  • Experience with endpoint, firewall, network, identity, cloud, application, infrastructure, vulnerability, or audit logs.
  • Experience with detection engineering, threat hunting, incident response, or Security Operations.
  • Experience with AWS security and data services.
  • Experience with Databricks, Delta Lake, or enterprise security data lakes.
  • Experience with Snowpark, Snowflake Cortex, Python UDFs, secure data sharing, or advanced Snowflake automation.
  • Experience with data governance, compliance, schema management, and data-quality controls.

Important Role Distinction

This position requires someone who has actively used Cribl to build and manipulate data flows.

Experience focused mainly on platform health, backend infrastructure, memory, system administration, observability monitoring, or confirming that data is flowing will not be sufficient without demonstrated hands-on experience developing Cribl pipelines, packs, field extractions, and transformations.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against TSG Risk Management's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on TSG Risk Management's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    TSG Risk Management's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.