Cribl Engineer
GuidePoint Security3 months ago
Responsibilities
- Lead architecture and design for Cribl Stream and Cribl Edge across multiple enclaves and data domains.
- Build high-throughput pipelines with routing, filtering, enrichment, and replay workflows.
- Optimize worker topology, CPU and memory distribution, queues, transport mechanisms, and overall system performance.
- Engineer secure data flows using masking, tokenization, RBAC, PKI/TLS, and governance controls.
- Integrate pipelines with Splunk, Elastic, SaaS telemetry platforms, and cloud services.
- Develop high-availability and disaster-recovery patterns, reliability frameworks, fleet health metrics, and failure-response processes.
- Maintain reusable Cribl Packs, shared patterns, runbooks, and operational standards.
- Serve as the senior escalation point for Cribl issues and coordinate with vendor engineering.
- Mentor engineers, conduct design reviews, drive engineering excellence, and enforce architectural standards.
- Support security, cloud, analytics, and infrastructure teams on logging and telemetry strategy.
Requirements
- Must possess a TS/SCI clearance with CI or full-scope polygraph.
- At least 10 years of experience in logging, observability, or SIEM engineering.
- At least 5 years of experience architecting enterprise-scale log and telemetry pipelines.
- At least 3 years of hands-on production experience with Cribl Stream and Cribl Edge.
- Experience operating and scaling pipelines processing 5–10 or more TB per day.
- Expertise with Splunk forwarding and ingestion, source type management, and indexing practices.
- Strong Linux fundamentals and scripting expertise in Python and Bash.
- Experience with Git, Ansible, and Terraform automation.
- Strong understanding of HTTP, TCP, TLS/mTLS, Kafka, and S3/object storage.
- Experience designing secure data flows involving encryption, RBAC, secrets management, and compliance controls.
- Ability to mentor senior engineers and lead technical decisions.
- Cribl Certified Engineer certification or equivalent Cribl product expertise.
- Must hold or obtain within 30 days an approved DoD 8570.01-M IAT Level II, IAT Level III, and CSSP Infrastructure Support certification.
- Preferred experience includes creating Cribl Packs, cloud telemetry across AWS and Azure, hybrid and cross-domain data movement, NIST and CIS control frameworks, distributed observability systems, and vendor engagement.
Benefits
- Primarily remote work for U.S.-based employees, with some travel and possible on-site work for federal positions.
- Medical insurance options including a zero-deductible PPO and high-deductible health plan with HSA contributions.
- Dental insurance with premiums covered at 100% for employees and 75% for family plans.
- 12 corporate holidays and a Flexible Time Off program.
- Mobile phone and home internet allowance.
- Retirement plan eligibility after two months at open enrollment.
- Pet benefit option.
About GuidePoint Security
GuidePoint Security provides cybersecurity consulting, managed services, and value-added reselling/integration of security products for enterprises and U.S. public-sector agencies. Its teams deliver assessments, penetration testing, cloud and application security, identity and access management, endpoint and network protection, and governance services. Founded in 2011 and headquartered in Reston, Virginia, the privately held company serves Fortune 500 organizations and cabinet-level federal agencies.