> Markdown version of [/jobs/ext/557242-cribl-engineer-active-ts-sci](https://www.wearedevelopers.com/jobs/ext/557242-cribl-engineer-active-ts-sci). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cribl Engineer - Active TS/SCI - **Company:** ENS Solutions, LLC - **Location:** College Park, MD, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Amazon S3, Microsoft Azure, Bash Shell, Software as a Service, Cyber Security, Information Engineering, Extract Transform Load (ETL), Data Security, Linux, Distributed Systems, Python (Programming Language), Key Management, Performance Tuning, Public Key Infrastructure, Role-Based Access Control, Cloud Services, Ansible, Security Information and Event Management, Transmission Control Protocol (TCP), Tokenization, Data Logging, Scripting, Indexer, Git, Transport Protocols, Apache Kafka, Terraform, Splunk - **Published:** June 12, 2026 - **Apply:** https://www.juju.com/job/00000000g7sbzc ## About the Role + 10+ years of experience in logging, observability, or SIEM engineering. + 5+ years architecting enterprise scale log/telemetry pipelines. + 3+ years hands-on with Cribl Stream and Cribl Edge in production environments. + Demonstrated success operating and scaling pipelines at 5-10+ TB/day. + Expert-level experience with Splunk forwarding/ingestion, source type management, and indexing practices. + Strong Linux fundamentals; scripting expertise (Python/Bash); Git; automation (Ansible/Terraform). + Strong understanding of transport protocols (HTTP, TCP, TLS/MTLS), Kafka, S3/object storage. + Experience designing secure data flows, including encryption, RBAC, secrets management, and compliance controls. + Demonstrated ability to mentor senior engineers and lead technical decision making. + Certified Cribl Certified Engineer (CCOE) or equivalent Cribl product expertise. + Must possess a TS/SCI; willingness to obtain a CI Poly + Must possess the following DoD 8570.01-M certifications or be willing to obtain within 30 days of hire: o Information Assurance Technician (IAT) Level II certification (currently Security+ CE, CCNA-Security, GSEC, SSCP, CySA+, GICSP, or CND). o IAT Level III certification requirements (currently CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, or GCIH). o Cyber Security Service Provider (CSSP) - Infrastructure Support (IS) certification requirements (currently CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND). Preferred Qualifications + Expertise creating and maintaining Cribl Packs and reusable pipelines. + Experience with cloud telemetry (AWS, Azure, hybrid) and cross-domain data movement patterns. + Familiarity with NIST / CIS control frameworks and secure engineering practices. + Experience building observability frameworks for large distributed systems. + Vendor engagement experience (Cribl PS, product teams, troubleshooting escalations). ## Description We are seeking a highly experienced Cribl Engineer to serve as the principal technical authority for observability pipelines built on Cribl Stream and Cribl Edge. This role is designed for a senior technologist with deep expertise in log/telemetry routing, largescale data engineering, and enterprise-grade observability architectures. You will shape pipeline strategy, design complex routing and transformation logic, drive platform reliability, mentor senior engineers, and serve as the top technical escalation point for Cribl-related challenges. What You'll Do + Lead architecture and design for Cribl Stream/Edge across multiple enclaves and data domains. + Build high throughput pipelines (multiTB/day) with advanced routing, filtering, enrichment, and replay workflows. + Optimize system performance, worker topology, CPU/memory distribution, queues, and transport mechanisms. + Engineer secure data flows with masking, tokenization, RBAC, PKI/TLS, and other governance controls. + Integrate pipelines with SIEM/analytics ecosystems (Splunk, Elastic, SaaS telemetry platforms, cloud services). + Develop HA/DR patterns, reliability frameworks, fleet health metrics, and failure mode response processes. + Maintain reusable Cribl packs, shared patterns, runbooks, and operational standards. + Serve as the senior escalation point for Cribl issues; interface with vendor engineering as required. + Mentor engineers, conduct design reviews, drive engineering excellence, and enforce architectural standards. + Support cross functional teams (security, cloud, analytics, infrastructure) on logging and telemetry strategy. ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [How a Small Team Shrank a Microsoft Monorepo by 94%](https://www.wearedevelopers.com/videos/1236-how-a-small-team-shrank-a-microsoft-monorepo-by-94) - [Enabling automated 1-click customer deployments with built-in quality and security](https://www.wearedevelopers.com/videos/83-enabling-automated-1-click-customer-deployments-with-built-in-quality-and-security) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [Unleashing Potential Across Teams: The Power of Infrastructure as Code](https://www.wearedevelopers.com/videos/930-unleashing-potential-across-teams-the-power-of-infrastructure-as-code) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Dev Digest 162: AI careers, MCP, AWS best practices & floppy sweaters](https://www.wearedevelopers.com/magazine/571-dev-digest-162-ai-careers-mcp-aws-best-practices-floppy-sweaters) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 188: CfP time, the risks of NPM and IKEA algorithms](https://www.wearedevelopers.com/magazine/635-dev-digest-188-cfp-time-the-risks-of-npm-and-ikea-algorithms) - [9 Claude Code Skills to Speed Up Your Workflow](https://www.wearedevelopers.com/magazine/740-9-claude-code-skills-to-speed-up-your-workflow) - [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence)