ROLE SUMMARY

Builds, manages, and optimizes enterprise data pipelines using Cribl Stream and Cribl Edge to feed downstream SIEM platforms. Focus on routing, filtering, transformation, and enrichment logic; normalizes log sources to standardized schemas (CIM, ECS, OCSF); and supports automation via scripting and infrastructure-as-code.

KEY REQUIREMENTS

•   3–5 years in IT with a focus on logging, observability, or SIEM engineering

•   2–5 years hands-on operating and managing data pipelines with Cribl Stream and/or Cribl Edge in production

•   2+ years administering/engineering enterprise SIEM (log forwarding, indexing, data collection, search architecture, source types, ingestion-time parsing)

•   Strong Regex and JavaScript within Cribl; Linux/Unix fundamentals; transport protocols (HTTP, TCP, TLS); data formats (JSON, Syslog)

•   Education/experience: HS/GED + 7 yrs, Associate's + 5 yrs, Bachelor's + 3 yrs, or Master's + 1 yr

•   Active Cribl certification (e.g., Cribl Certified Observability Engineer – CCOE)

REQUIRED CERTIFICATIONS

•   Baseline: IAT Level III

•   Admin privileges (PUA): Computing Environment

•   CSSP-IS

•   Cert path: ability to obtain a DoD 8570.01-M CSSP-IS certification within 30 days of offer acceptance; and a DoD 8570 IAT Level III certification within 45 days of the CSSP-IS date