1 day ago
Base Salary
$265k - $320k/yr
Responsibilities
- Set long-term product and cloud security direction across multiple teams, including roadmaps, standards, secure-by-default patterns, and risk-informed release decisions.
- Lead product security reviews covering architecture, design, threat modeling, abuse cases, targeted secure code review, and security test planning.
- Translate security risks into engineering requirements, mitigations, tests, secure defaults, and verified outcomes.
- Serve as a cloud security authority for IAM, workload identity, network exposure, encryption, secrets, logging, detection, containers, Kubernetes, serverless services, infrastructure as code, hardening, and data isolation.
- Lead product security engineering for FedRAMP, including technical controls, evidence, authorization boundaries, continuous monitoring, vulnerability and change management, remediation, incident response, and assessor interactions.
- Investigate vulnerabilities and ambiguous security signals, coordinate remediation, validate fixes and bypasses, and identify variants and root causes.
- Build security capabilities and developer paved roads across CI/CD, SAST, SCA, secrets, infrastructure as code, containers, cloud posture, and testing.
- Scope and oversee penetration tests, purple-team exercises, and security vendors, ensuring findings become verified engineering outcomes.
- Lead multi-team security work, communicate risks and recommendations to varied audiences, mentor security engineers and partners, and create durable standards, runbooks, automation, and continuity plans.
- Evaluate and apply emerging technologies, including AI-assisted security engineering, with verification and human accountability.
Requirements
- Typically 10+ years of relevant software security, security engineering, or software engineering experience, or equivalent demonstrated scope and impact.
- Principal-level experience setting technical direction across teams, leading multi-quarter initiatives, resolving ambiguous critical problems, and influencing senior leaders without direct authority.
- Substantial hands-on application or product security and cloud security experience, including securing AI or agentic systems.
- Deep production SaaS or cloud-native security experience with AWS and Azure, including identity, authorization, network controls, encryption, key management, secrets, logging, detection, containers or Kubernetes, serverless services, infrastructure as code, and multi-tenant data isolation.
- Experience implementing or operating product and cloud security controls in FedRAMP-authorized or FedRAMP-bound environments, including NIST SP 800-53 controls, evidence, continuous monitoring, remediation, and assessor interactions.
- Expertise leading security design reviews and threat models for complex applications, APIs, distributed systems, and cloud architectures.
- Strong knowledge of web and application vulnerabilities, exploit techniques, OWASP guidance, authentication and authorization protocols, cryptography, network protocols, and secure cloud operating models.
- Ability to read production code and build maintainable automation in JavaScript or TypeScript, Python, Go, or a comparable language.
- Hands-on vulnerability-response experience covering exploitability, root-cause and variant analysis, remediation design, fix and bypass validation, coordination, and incident support.
- Bachelor’s degree in computer science, cybersecurity, or a related field, or equivalent practical experience.
- Preferred qualifications include experience with enterprise data platforms, observability systems, high-volume data pipelines, agents, customer-managed or hybrid software, AWS GovCloud, FedRAMP Moderate or High, NIST 800-53, developer security platforms, policy-as-code, automated guardrails, public security contributions, or relevant security credentials such as AWS Certified Security – Specialty, CISSP, CCSP, CSSLP, GIAC, or OSCP.
Benefits
- Remote-first work arrangement with a global workforce.
- Health, dental, vision, short-term disability, and life insurance.
- Paid holidays and paid time off.
- Fertility treatment benefit, 401(k), and equity.
- Corporate Bonus Program eligibility for non-sales roles.
- The role requires stand-by, on-call, or off-hours duties.
Categories
About Cribl
Cribl builds a vendor‑agnostic telemetry data platform used by IT, security, and observability teams to collect, route, shape, store, and search machine data in real time. Its products (including Cribl Stream, Edge, and Search) are sold as enterprise subscriptions and can run in cloud or self‑managed environments. Founded in 2018 and headquartered in San Francisco, the company is privately held and serves large global enterprises.