Staff Threat Protection Engineer

Cribl

. Lead insider risk investigations from initial detection through closure, including scoping, evidence collection, interviews, findings, and remediation recommendations .

Posted 10/7/2026full-timeCalifornia • United StatesLead💰 $128,000 - $200,000 per yearWebsite

Tech Stack

Tools & technologies

TypeScript

About the role

Key responsibilities & impact

Lead insider risk investigations from initial detection through closure, including scoping, evidence collection, interviews, findings, and remediation recommendations
Partner with HR, Legal, and Employee Relations on defensible, confidential, legally compliant investigations
Build and mature insider risk program components, detection use cases, escalation criteria, case management workflows, and cross-functional playbooks
Brief sensitive findings to Legal, HR, and executive leadership
Conduct forensic acquisition and analysis of laptops, mobile devices, removable media, and network artifacts
Maintain chain of custody and produce litigation-ready documentation
Perform hardware-level forensics, including disk imaging, device teardown/analysis, and embedded storage analysis
Provide executive protection during domestic and international travel, company events, and conferences
Lead security planning for conferences and events
Conduct pre-travel intelligence and geopolitical, environmental, and venue-specific risk assessments
Coordinate with executive assistants on itineraries, logistics, and advance planning
Support physical security assessments of offices, facilities, and events

Requirements

What you’ll need

7+ years of experience across insider threat investigations, digital/hardware forensics, and physical/executive protection, or equivalent depth
Demonstrated experience serving as lead investigator on insider risk cases involving sensitive, high-stakes, or legally exposed matters
Working knowledge of employment law, HR investigation standards, and confidentiality requirements
Hands-on forensic skills with EnCase, FTK, Cellebrite, X-Ways, and hardware-level forensic techniques
Active or recent IACIS CFCE or comparable digital forensics credential
Prior experience in executive protection, including travel risk assessment/intelligence gathering and coordination with executive support staff
Excellent judgment and discretion
Strong written and verbal communication skills
Willingness and ability to travel on short notice, including internationally
Background in law enforcement, military, or federal investigative service preferred
Experience building or scaling an insider risk program preferred
TS-level clearance preferred; Secret will be reviewed
Familiarity with UEBA/DLP tooling and insider threat detection platforms preferred

Benefits

Comp & perks

Health insurance
Dental insurance
Vision insurance
Short-term disability insurance
Life insurance
Paid holidays
Paid time off
Fertility treatment benefit
401(k)
Equity
Cribl Corporate Bonus Program
Remote-first work environment