Cribl Engineer

GuidePoint Security is seeking a skilled Cribl Engineer to join the Visibility Analytics and Automation Team (VAAT). The successful candidate will play a crucial role in building, managing, and optimising enterprise data pipelines, with a strong focus on feeding the downstream SIEM ecosystem.

The primary focus will be designing and maintaining routing, filtering, and transformation logic using Cribl Stream and Cribl Edge. The ideal candidate will be passionate about logging, SIEM architecture, and solving complex data ingestion challenges.

Responsibilities:

• Build, maintain, and optimise high-throughput data pipelines using Cribl Stream and Cribl Edge to ensure efficient data routing, masking, and transformation.
• Normalize incoming log sources to standardised schemas (e.g., CIM, ECS) before routing to downstream SIEM platforms, analytics tools, and storage.
• Implement complex routing logic, data masking, enrichment, and replay workflows, utilising custom JavaScript functions and Regex patterns directly within Cribl pipelines.
• Monitor system health, assist in managing worker topology, and troubleshoot bottlenecks or failures in the data flow.
• Utilise scripting (Python, Bash) and infrastructure-as-code tools (Ansible, Terraform) to automate deployment and configuration management.
• Maintain clear and accurate technical documentation, runbooks, and standard operating procedures for the observability infrastructure.

Requirements:

• Active TS/SCI clearance; willingness to take a polygraph exam.
• 3–5 years of experience in Information Technology, focusing on logging, observability, or SIEM engineering.
• 2–5 years of hands-on experience operating and managing data pipelines with Cribl Stream and/or Cribl Edge in a production environment.
• 2+ years of experience administering or engineering enterprise SIEM environments, including a strong understanding of log forwarding, indexing, data collection, search architecture, source types, and ingestion-time parsing.
• Education: HS diploma OR GED and 7+ years of experience with supporting IT projects and activities; Associate’s degree and 5+ years of experience supporting IT projects and activities; Bachelor’s degree and 3+ years of experience supporting IT projects and activities; Master’s degree and 1+ years of experience supporting IT projects and activities.
• Ability to obtain a DoD 8570.01-M Cybersecurity Service Provider - Infrastructure Support (CSSP-IS) Certification, including CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND certification within 30 days of offer accept.
• Ability to obtain a DoD 8570 IAT Level III Certification such as SecurityX (formerly CASP+), CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP certification within 45 days of CSSP-IS date (or offer accept if candidate already has CSSP-IS Cert).
• Active Cribl Certification (e.g., Cribl Certified Observability Engineer - CCOE).

Preferred Experience and Education:

• Relevant enterprise SIEM administrator or engineering certifications.
• Understanding of data security fundamentals, including encryption, RBAC, and data masking strategies.
• Strong fundamentals in Linux/Unix administration and working knowledge of transport protocols (HTTP, TCP, TLS) and data formats (JSON, Syslog).
• Regex: Strong proficiency in writing complex Regular Expressions (Regex) for pattern matching, data extraction, and log parsing.
• JavaScript: Solid proficiency using JavaScript within Cribl’s native execution environment to write custom functions, execute advanced data transformations, and manipulate JSON/event payloads inside pipelines.
• Log Schema Formats: Solid understanding of log normalisation concepts and schema alignment, specifically Common Information Model (CIM) or similar frameworks (e.g., ECS, OCSF).
• Systems & Protocols: Strong fundamentals in Linux/Unix administration and working knowledge of transport protocols (HTTP, TCP, TLS) and data formats (JSON, Syslog).
• Excellent problem-solving abilities, strong attention to detail, and the ability to collaborate effectively in a team environment.

Travel Requirements:

• This position requires 100% onsite support in Reston, VA OR Washington, D.C. location.

Physical Requirements:

• Sedentary work.
• Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day.
• Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day.

Benefits:

• Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions).
• Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans); High Deductible Health Plan with HSA (GuidePoint pays 100% of the employees premiums and 75% for family plans).
• Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans.
• 12 corporate holidays and a Flexible Time Off (FTO) program.
• Healthy mobile phone and home internet allowance.
• Eligibility for retirement plan after 2 months at open enrollment.
• Pet Benefit Option.