Senior Cribl Pipeline Engineer / Security Data Engineer

TSG Risk Management

. Develop, implement, and maintain enterprise data-processing pipelines using Cribl LogStream/Stream .

Posted 11/6/2026full-timeUnited StatesSenior💰 $170,000 - $220,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in developing and maintaining enterprise data-processing pipelines using Cribl LogStream, Snowflake, and various security telemetry sources. Proficient in troubleshooting, optimizing, and documenting data flows while collaborating effectively with cross-functional technical teams.

Highest-signal resume keywords

Cribl LogStream DevelopmentSnowflake AdministrationData Pipeline AutomationSecurity Telemetry MappingProblem-Solving Skills

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Cribl LogStreamSnowflakePythonJavaScriptData TransformationField ExtractionData NormalizationData Quality ControlPipeline TroubleshootingData Ingestion

Soft Skills

Communication SkillsDocumentation SkillsCollaboration SkillsProblem-Solving Skills

Tools & Technologies

AWSDatabricksSIEM PlatformsSecurity ToolsObservability Platforms

Industry Keywords

Security AnalyticsDetection EngineeringIncident ResponseData GovernanceCompliance

Tech Stack

Tools & technologies

AWSCloudJavaScriptPythonSnowflakeSplunk

About the role

Key responsibilities & impact

Develop, implement, and maintain enterprise data-processing pipelines using Cribl LogStream/Stream
Build and maintain Cribl pipelines, packs, routes, functions, parsers, and reusable content
Perform field extraction, parsing, filtering, masking, enrichment, normalization, and transformation
Map security telemetry to OCSF or other standardized data schemas
Build and support integrations between Cribl, Snowflake, Databricks, AWS, SIEM platforms, security tools, observability platforms, and enterprise data lakes
Onboard and validate endpoint, firewall, identity, cloud, audit, application, infrastructure, and network telemetry
Validate transformed events contain fields required by SIEM, detection engineering, threat-hunting, incident-response, and security-analytics teams
Troubleshoot pipeline logic, malformed events, parsing failures, schema drift, field-mapping problems, dropped data, and data-quality issues
Monitor pipeline performance and optimize routing, transformations, and data volumes
Develop and support automated ingestion and source-onboarding workflows
Create and maintain Snowflake databases, schemas, tables, views, streams, tasks, stored procedures, and data pipelines
Collaborate with Security Operations, Detection Engineering, Data Engineering, Infrastructure, Analytics, and platform teams
Document pipeline configurations, source-to-target mappings, operational procedures, and end-to-end data flows

Requirements

What you’ll need

At least 3 years of substantial hands-on experience using Cribl LogStream/Stream to develop and maintain pipelines, packs, routes, functions, parsers, and field-level transformations
Demonstrated experience with Cribl field extraction, parsing, enrichment, filtering, normalization, transformation, and routing
Ability to clearly explain an end-to-end data flow, including the original source, processing performed in Cribl, and the downstream destination
Experience building and supporting large-scale enterprise data-ingestion and processing pipelines
Experience onboarding data into SIEM, security data lake, observability, analytics, or similar enterprise platforms
Experience troubleshooting pipeline failures, malformed events, missing fields, schema changes, performance problems, and data-quality issues
Experience with Python, JavaScript, or a similar scripting language for pipeline automation
At least 2 years of hands-on Snowflake administration, architecture, or data-engineering experience in a large enterprise environment
Experience designing or maintaining Snowflake databases, schemas, tables, views, streams, tasks, stored procedures, or ingestion pipelines
Strong problem-solving, debugging, documentation, and communication skills
Ability to work effectively with technical teams across security, data, infrastructure, operations, and analytics
Preferred: Experience mapping security data to OCSF
Preferred: Experience developing and maintaining custom Cribl packs
Preferred: Experience with security telemetry, security data normalization, or security analytics
Preferred: Experience with Splunk, including Splunk Enterprise or Splunk Enterprise Security
Preferred: Experience with SIEM architecture, SIEM migrations, or security-data onboarding
Preferred: Experience with endpoint, firewall, network, identity, cloud, application, infrastructure, vulnerability, or audit logs
Preferred: Experience with detection engineering, threat hunting, incident response, or Security Operations
Preferred: Experience with AWS security and data services
Preferred: Experience with Databricks, Delta Lake, or enterprise security data lakes
Preferred: Experience with Snowpark, Snowflake Cortex, Python UDFs, secure data sharing, or advanced Snowflake automation
Preferred: Experience with data governance, compliance, schema management, and data-quality controls

Benefits

Comp & perks

Flexible hybrid or remote work model