Cribl Engineer - TS​/SCI CI Poly

• Pipeline Development:
  Build, maintain, and optimize high-throughput data pipelines using Cribl Stream and Cribl Edge to ensure efficient data routing, masking, and transformation.
• Data Integration & Schema Mapping:
  Normalize incoming log sources to standardized schemas (e.g., CIM, ECS) before routing to downstream SIEM platforms, analytics tools, and storage.
• Engineering Support:
  Implement complex routing logic, data masking, enrichment, and replay workflows, utilizing custom JavaScript functions and Regex patterns directly within Cribl pipelines.
• System Optimization:
  Monitor system health, assist in managing worker topology, and troubleshoot bottlenecks or failures in the data flow.
• Automation:
  Utilize scripting (Python, Bash) and infrastructure-as-code tools (Ansible, Terraform) to automate deployment and configuration management.
• Documentation:
  Maintain clear and accurate technical documentation, runbooks, and standard operating procedures for the observability infrastructure.

• 3–5 years of experience in Information Technology, focusing on logging, observability, or SIEM engineering.
• 2–5 years of hands‑on experience operating and managing data pipelines with Cribl Stream and/or Cribl Edge in a production environment.
• 2+ years of experience administering or engineering enterprise SIEM environments, including a strong understanding of log forwarding, indexing, data collection, search architecture, source types, and ingestion‑time parsing.
• HS diploma or GED and 7+ years of experience with supporting IT projects and activities, Associate’s degree and 5+ years of experience supporting IT projects and activities, Bachelor’s degree and 3+ years of experience supporting IT projects and activities, or Master’s degree and 1+ years of experience supporting IT projects and activities.
• Ability to obtain a DoD 8570.01‑M Cybersecurity Service Provider - Infrastructure Support (CSSP‑IS) Certification, including CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND certification within 30 days of offer accept
• Ability to obtain a DoD 8570 IAT Level III Certification such as SecurityX (formerly CASP+), CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP certification within 45 days of CSSP‑IS date (or offer accept if candidate already has CSSP‑IS Cert).
• Active Cribl Certification (e.g., Cribl Certified Observability Engineer - CCOE).

• Relevant enterprise SIEM administrator or engineering certifications.
• Understanding of data security fundamentals, including encryption, RBAC, and data masking strategies.
• Strong fundamentals in Linux/Unix administration and working knowledge of transport protocols (HTTP, TCP, TLS) and data formats (JSON, Syslog).

Technical

Skills:

• Regex:
  Strong proficiency in writing complex Regular Expressions (Regex) for pattern matching, data extraction, and log parsing.
• JavaScript:
  Solid proficiency using JavaScript within Cribl's native execution environment to write custom functions, execute advanced data transformations, and manipulate JSON/event payloads inside pipelines.
• Log Schema Formats:
  Solid understanding of log normalization concepts and schema alignment, specifically Common Information Model (CIM) or similar frameworks (e.g., ECS, OCSF).
• Systems & Protocols:
  Strong fundamentals in Linux/Unix administration and working knowledge of transport protocols (HTTP, TCP, TLS) and data formats (JSON, Syslog).
• Excellent problem‑solving abilities, strong attention to detail, and the ability to collaborate effectively in a team environment.

Essential Network Security (ENS) Solutions, LLC is a service‑disabled veteran owned, highly regarded IT consulting and management firm. ENS consults for the Department of Defense (DoD) and Intelligence Community (IC)…