Senior Cribl Engineer

About the role

As a Senior Cribl Engineer at Optiv, you will architect and administer data routing infrastructure using Cribl Stream, Edge, Lake, and Search to intercept, transform, and route machine data to destinations like Splunk, Google SecOps, Crowdstrike NGS, and Exabeam. Day-to-day work includes designing scalable Cribl Worker Groups and Leader Nodes across multi-cloud and on-premise environments, building processing pipelines with Regex and JavaScript, implementing data reduction and masking for PII/PHI compliance, and collaborating with Security (SOC) and DevOps teams. The role is based in Bangalore, Karnataka, follows a hybrid work model requiring reporting to the office 3 days a week, and involves 2pm to 11pm shifts with on-call support.

What you’ll do

• Design and deploy scalable Cribl Worker Groups and Leader Nodes across multi-cloud and on-premise environments.
• Configure and maintain distributed deployments using Cribl Edge for fleet management.
• Integrate diverse data sources including Syslog, HTTP (HEC), Kafka, AWS S3/CloudWatch, Azure Event Hubs, and various API-based collectors.
• Build processing pipelines using Regex, JavaScript, and built-in Cribl functions to parse, filter, and enrich data.
• Implement Data Reduction strategies (sampling, aggregation, dropping null fields) to reduce SIEM/log management costs by 30% or more.
• Perform Data Masking and Obfuscation to ensure PII/PHI compliance before data reaches downstream analytics tools.
• Normalize disparate log formats into a Common Information Model (CIM) or Open Cybersecurity Schema Framework (OCSF).
• Monitor the health, performance, and throughput of the Cribl infrastructure and manage version control for Cribl configurations using Git (GitOps workflow).

What you’ll bring

• Bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent work experience).
• 3+ years of experience in Observability, Data Engineering, or Security Operations.
• Deep hands-on experience with Cribl (Stream, Edge, Search, Lake).
• Understanding of JavaScript and Regex for data parsing and complex transforms.
• Experience with at least one or two major downstream tools (Splunk, Crowdstrike NGS, Exabeam, Google SecOps, etc.).
• Solid understanding of Linux/Unix administration, Docker/Kubernetes, and networking protocols (TCP/UDP, HTTP/S, TLS).
• Experience with AWS, Azure, or GCP (specifically storage and compute services like S3, Lambda, EC2).
• Experience with Git and CI/CD pipelines.

Nice to have

• Cribl Certified Observability Engineer (CCOE) or Cribl Stream User/Admin certifications are highly desirable.
• Experience with Terraform or Ansible is preferred.
• Proficient in writing and speaking English; must possess professional communication skills, verbal and written, for meetings with client leadership.

Skills

Benefits

• Work/life balance
• Professional training resources
• Creative problem-solving and the ability to tackle unique, complex projects
• Volunteer Opportunities ('Optiv Chips In')
• The ability and technology necessary to productively work remotely/from home (where applicable)

Education

Bachelor's degree in Computer Science, Information Technology, or a related field (or equivalent work experience).