Principal Product Security Engineer

About this role

Lead product and cloud security direction across Cribl’s SaaS, customer-managed, and hybrid products. This hands-on principal role combines application security, cloud security, vulnerability response, and FedRAMP engineering, with broad influence across teams.

About the company

Cribl builds observability pipelines that route, reshape, and reduce telemetry data before it reaches downstream tools. It serves teams that need more control over log, metric, and trace costs.

Stack

What you'll do

• Set long-term product and cloud security direction across teams.
• Lead security reviews, threat modeling, abuse-case analysis, and targeted code reviews.
• Translate security risks and FedRAMP requirements into controls, mitigations, tests, and defensible evidence.
• Build and operate security automation and developer-focused paved roads across CI/CD, code, supply chain, containers, and cloud.
• Lead vulnerability investigations, remediation, fix validation, and root-cause analysis.
• Oversee penetration tests, purple-team exercises, and security vendors; ensure findings are resolved and verified.
• Mentor engineers and security partners, and communicate security tradeoffs to technical and business stakeholders.
• Participate in on-call, standby, or off-hours duties.

What we're looking for

• Typically 10+ years of relevant software security, security engineering, or software engineering experience, or equivalent impact.
• Principal-level experience setting technical direction and leading cross-team initiatives without direct authority.
• Hands-on AWS and Azure security experience in production SaaS or cloud-native systems.
• Experience implementing or operating controls in a FedRAMP-authorized or FedRAMP-bound environment, including NIST SP 800-53 controls and assessor interactions.
• Expertise in security design reviews and threat modeling for applications, APIs, distributed systems, and cloud architectures.
• Strong knowledge of application vulnerabilities, exploit techniques, authentication and authorization, cryptography, and secure cloud operations.
• Ability to read production code and build automation in JavaScript, TypeScript, Python, Go, or a comparable language.
• Experience with vulnerability response, including exploitability analysis, remediation design, and fix and bypass validation.

Nice to have

• Experience with enterprise data platforms, observability systems, high-volume data pipelines, agents, or customer-managed and hybrid software.
• Experience with AWS GovCloud, FedRAMP Moderate or High, and NIST 800-53.
• Experience building developer security platforms, secure-by-default libraries, policy-as-code, or automated security guardrails.
• Public security contributions or thought leadership, such as open-source work, research, CVEs, standards participation, or conference talks.
• Relevant credentials such as AWS Certified Security – Specialty, CISSP, CCSP, CSSLP, GIAC, or OSCP.

Benefits

• Corporate bonus program
• Equity
• Health, dental, vision, short-term disability, and life insurance
• Paid holidays and paid time off
• Fertility treatment benefit
• 401(k)