Senior Cribl Pipeline Engineer / Security Data Engineer

TSG Risk Management•Charlotte, NC

About The Position

This is a hands-on Cribl development role focused on building, maintaining, and optimizing scalable enterprise data pipelines using Cribl LogStream/Stream. The engineer will develop pipelines, packs, routes, functions, parsers, and field-level transformations to process and deliver enterprise data. The position emphasizes extracting and mapping fields, parsing and normalizing data, creating reusable Cribl content, and routing information to Snowflake, Databricks, SIEM platforms, security analytics tools, or enterprise data lakes. It is not primarily a backend infrastructure administration or platform-monitoring role. The role also includes Snowflake engineering and administration, data-source onboarding, pipeline troubleshooting and optimization, and collaboration with security, data, infrastructure, operations, and analytics teams. Security telemetry and OCSF mapping, along with experience in Snowflake, Splunk, AWS, and enterprise-scale data environments, are strongly preferred. Candidates with substantial hands-on Cribl pipeline development in Splunk, observability, or infrastructure environments may also be considered.

Requirements

At least 3 years of substantial hands-on experience using Cribl LogStream/Stream to develop and maintain pipelines, packs, routes, functions, parsers, and field-level transformations.
Demonstrated experience with Cribl field extraction, parsing, enrichment, filtering, normalization, transformation, and routing.
Ability to explain an end-to-end data flow, including the original source, processing performed in Cribl, and downstream destination.
Experience building and supporting large-scale enterprise data-ingestion and processing pipelines.
Experience onboarding data into SIEM, security data lake, observability, analytics, or similar enterprise platforms.
Experience troubleshooting pipeline failures, malformed events, missing fields, schema changes, performance problems, and data-quality issues.
Experience with Python, JavaScript, or a similar scripting language for pipeline automation.
At least 2 years of hands-on Snowflake administration, architecture, or data-engineering experience in a large enterprise environment.
Experience designing or maintaining Snowflake databases, schemas, tables, views, streams, tasks, stored procedures, or ingestion pipelines.
Strong problem-solving, debugging, documentation, and communication skills.
Ability to work effectively with technical teams across security, data, infrastructure, operations, and analytics.

Nice To Haves

Experience mapping security data to OCSF.
Experience developing and maintaining custom Cribl packs.
Experience with security telemetry, security data normalization, or security analytics.
Experience with Splunk, including Splunk Enterprise or Splunk Enterprise Security.
Experience with SIEM architecture, SIEM migrations, or security-data onboarding.
Experience with endpoint, firewall, network, identity, cloud, application, infrastructure, vulnerability, or audit logs.
Experience with detection engineering, threat hunting, incident response, or Security Operations.
Experience with AWS security and data services.
Experience with Databricks, Delta Lake, or enterprise security data lakes.
Experience with Snowpark, Snowflake Cortex, Python UDFs, secure data sharing, or advanced Snowflake automation.
Experience with data governance, compliance, schema management, and data-quality controls.
Substantial hands-on Cribl pipeline development experience in Splunk, observability, or infrastructure environments.

Responsibilities

Develop, implement, and maintain enterprise data-processing pipelines using Cribl LogStream/Stream.
Build and maintain Cribl pipelines, packs, routes, functions, parsers, and reusable content.
Perform field extraction, parsing, filtering, masking, enrichment, normalization, and transformation.
Map security telemetry to OCSF or other standardized data schemas.
Build and support integrations between Cribl and Snowflake, Databricks, AWS, SIEM platforms, security tools, observability platforms, and enterprise data lakes.
Onboard and validate data sources, including endpoint, firewall, identity, cloud, audit, application, infrastructure, and network telemetry.
Validate that transformed events contain the fields required by SIEM, detection engineering, threat-hunting, incident-response, and security-analytics teams.
Troubleshoot pipeline logic, malformed events, parsing failures, schema drift, field-mapping problems, dropped data, and data-quality issues.
Monitor pipeline performance and optimize routing, transformations, and data volumes.
Develop and support automated ingestion and source-onboarding workflows.
Create and maintain Snowflake databases, schemas, tables, views, streams, tasks, stored procedures, and data pipelines.
Collaborate with Security Operations, Detection Engineering, Data Engineering, Infrastructure, Analytics, and platform teams.
Document pipeline configurations, source-to-target mappings, operational procedures, and end-to-end data flows.