> Markdown version of [/jobs/ext/1242254-cribl-engineer-active-ts-sci](https://www.wearedevelopers.com/jobs/ext/1242254-cribl-engineer-active-ts-sci). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cribl Engineer - Active TS/SCI - **Company:** TAXATION SOLUTIONS - **Location:** Seattle, WA, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Amazon S3, Microsoft Azure, Bash Shell, Software as a Service, Cyber Security, Information Engineering, Extract Transform Load (ETL), Data Security, Linux, Python (Programming Language), Key Management, Public Key Infrastructure, Role-Based Access Control, Cloud Services, Ansible, Security Information and Event Management, Transmission Control Protocol (TCP), Tokenization, Data Logging, Scripting, Indexer, Git, Transport Protocols, Apache Kafka, Terraform, Splunk - **Published:** July 11, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=997a62b7baee9125 ## About the Role pipelines with SIEM/analytics ecosystems (Splunk, Elastic, SaaS telemetry platforms, cloud services).Develop HA/DR patterns, reliability frameworks, fleet health metrics, and failure mode response processes.Maintain reusable Cribl packs, shared patterns, runbooks, and operational standards.Serve as the senior escalation point for Cribl issues; interface with vendor engineering as required.Mentor engineers, conduct design reviews, drive engineering excellence, and enforce architectural standards.Support cross functional teams (security, cloud, analytics, infrastructure) on logging and telemetry strategy.Qualifications10+ years of experience in logging, observability, or SIEM engineering.5+ years architecting enterprise scale log/telemetry pipelines.3+ years hands-on with Cribl Stream and Cribl Edge in production environments.Demonstrated success operating and scaling pipelines at 5-10+ TB/day.Expert-level experience with Splunk forwarding/ingestion, source type management, and indexing practices.Strong Linux fundamentals; scripting expertise (Python/Bash); Git; automation (Ansible/Terraform).Strong understanding of transport protocols (HTTP, TCP, TLS/MTLS), Kafka, S3/object storage.Experience designing secure data flows, including encryption, RBAC, secrets management, and compliance controls.Demonstrated ability to mentor senior engineers and lead technical decision making.Certified Cribl Certified Engineer (CCOE) or equivalent Cribl product expertise.Must possess a TS/SCI; willingness to obtain a CI Poly.Must possess the following DoD 8570.01-M certifications or be willing to obtain within 30 days of hire:Information Assurance Technician (IAT) Level II certification (currently Security+ CE, CCNA-Security, GSEC, SSCP, CySA+, GICSP, or CND).IAT Level III certification requirements (currently CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, or GCIH).Cyber Security Service Provider (CSSP) - Infrastructure Support (IS) certification requirements (currently CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND).Preferred QualificationsExpertise creating and maintaining Cribl Packs and reusable pipelines.Experience with cloud telemetry (AWS, Azure, hybrid) and cross-domain data movement patterns.Familiarity with NIST / CIS control frameworks and secure engineering practices.Experience building observability frameworks for large distributed systems.Vendor engagement experience (Cribl PS, product teams, troubleshooting escalations).Why ENS?Free Platinum-Level Medical/Dental/Vision coverage, 100% paid for by ENS401k Contribution from Day 1PTO + 11 Paid Federal HolidaysLong & Short Term Disability InsuranceGroup Term Life InsuranceTuition, Certification & Professional Development AssistanceWorkers' CompensationRelocation Assistance#J-18808-Ljbffr Role OverviewWe are seeking a highly experienced Cribl Engineer to serve as the principal technical authority for observability pipelines built on Cribl Stream and Cribl Edge. This role is designed for a senior technologist with deep expertise in log/telemetry routing, largescale data engineering, and enterprise-grade observability architectures.You will shape pipeline strategy, design complex routing and transformation logic, drive platform reliability, mentor senior engineers, and serve as the top technical escalation point for Cribl-related challenges.What You'll DoLead architecture and design for Cribl Stream/Edge across multiple enclaves and data domains.Build high throughput pipelines (multiTB/day) with advanced routing, filtering, enrichment, and replay workflows.Optimize system performance, worker topology, CPU/memory distribution, queues, and transport mechanisms.Engineer secure data flows with masking, tokenization, RBAC, PKI/TLS, and other governance controls.Integrate pipelines with SIEM/analytics ecosystems (Splunk, Elastic, SaaS telemetry platforms, cloud services).Develop HA/DR patterns, reliability frameworks, fleet health metrics, and failure mode response processes.Maintain reusable Cribl packs, shared patterns, runbooks, and operational standards.Serve as the senior escalation point for Cribl issues; interface with vendor engineering as required.Mentor engineers, conduct design reviews, drive engineering excellence, and enforce architectural standards.Support cross functional teams (security, cloud, analytics, infrastructure) on logging and telemetry strategy.Qualifications10+ years of experience in logging, observability, or SIEM engineering.5+ years architecting enterprise scale log/telemetry pipelines.3+ years hands-on with Cribl Stream and Cribl Edge in production environments.Demonstrated success operating and scaling pipelines at 5-10+ TB/day.Expert-level experience with Splunk forwarding/ingestion, source type management, and indexing practices.Strong Linux fundamentals; scripting expertise (Python/Bash); Git; automation (Ansible/Terraform).Strong understanding of transport protocols (HTTP, TCP, TLS/MTLS), Kafka, S3/object storage.Experience designing secure data flows, including encryption, RBAC, secrets management, and compliance controls.Demonstrated ability to mentor senior engineers and lead technical decision making.Certified Cribl Certified Engineer (CCOE) or equivalent Cribl product expertise.Must possess a TS/SCI; willingness to obtain a CI Poly.Must possess the following DoD 8570.01-M certifications or be willing to obtain within 30 days of hire:Information Assurance Technician (IAT) Level II certification (currently Security+ CE, CCNA-Security, GSEC, SSCP, CySA+, GICSP, or CND).IAT Level III certification requirements (currently CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, or GCIH).Cyber Security Service Provider (CSSP) - Infrastructure Support (IS) certification requirements (currently CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND).Preferred QualificationsExpertise creating and maintaining Cribl Packs and reusable pipelines.Experience with cloud telemetry (AWS, Azure, hybrid) and cross-domain data movement patterns.Familiarity with NIST / CIS control frameworks and secure engineering practices.Experience building observability frameworks for large distributed systems.Vendor engagement experience (Cribl PS, product teams, troubleshooting escalations).Why ENS?Free Platinum-Level Medical/Dental/Vision coverage, 100% paid for by ENS401k Contribution from Day 1PTO + 11 Paid Federal HolidaysLong & Short Term Disability InsuranceGroup Term Life InsuranceTuition, Certification & Professional Development AssistanceWorkers' CompensationRelocation Assistance#J-18808-Ljbffr ## Description Role OverviewWe are seeking a highly experienced Cribl Engineer to serve as the principal technical authority for observability pipelines built on Cribl Stream and Cribl Edge. This role is designed for a senior technologist with deep expertise in log/telemetry routing, largescale data engineering, and enterprise-grade observability architectures.You will shape pipeline strategy, design complex routing and transformation logic, drive platform reliability, mentor senior engineers, and serve as the top technical escalation point for Cribl-related challenges.What You'll DoLead architecture and design for Cribl Stream/Edge across multiple enclaves and data domains.Build high throughput pipelines (multiTB/day) with advanced routing, filtering, enrichment, and replay workflows.Optimize system performance, worker topology, CPU/memory distribution, queues, and transport mechanisms.Engineer secure data flows with masking, tokenization, RBAC, PKI/TLS, and other governance controls.Integrate ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [How a Small Team Shrank a Microsoft Monorepo by 94%](https://www.wearedevelopers.com/videos/1236-how-a-small-team-shrank-a-microsoft-monorepo-by-94) - [Plan CI/CD on the Enterprise level!](https://www.wearedevelopers.com/videos/544-plan-ci-cd-on-the-enterprise-level) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [Enabling automated 1-click customer deployments with built-in quality and security](https://www.wearedevelopers.com/videos/83-enabling-automated-1-click-customer-deployments-with-built-in-quality-and-security) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk) - [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)