Join the company that’s building the telemetry infrastructure for the AI era. At Cribl, we partner with IT and Security teams at many of the world’s biggest enterprises, including half of the Fortune 100, to bridge the gap between AI ambition and infrastructure reality. As the AI Platform for Telemetry, we give customers the choice, control, and flexibility to manage and analyze telemetry for both humans and agents, so they can build what’s next.

We’re one of the fastest‑growing private companies and a leading player in a massive, fast‑moving market. With a global workforce, we’re remote‑first and grounded in a simple idea: software is a people business. Cribl is the place where curious, collaborative people can do their best work, grow fast, and bring their full selves to the herd.

Why You’ll Love This Role

Cribl is looking for a Principal Product Security Engineer to serve as a hands-on technical authority at the intersection of application, cloud, and FedRAMP environment security. You will help secure Cribl’s cloud-native, customer-managed, and hybrid products as they process high-volume data for some of the world’s largest organizations.

As a Principal engineer, impact is defined by reach. You will set long-term direction across teams, resolve critical and ambiguous security problems, advise Engineering and Product leaders, and turn security requirements into secure designs, production-ready patterns, automation, and verified outcomes. This is not a documentation-only compliance role: you will work with Engineering, SRE, Cloud Operations, Compliance, and Product Security Incident Response Team (PSIRT) partners to make regulatory commitments real in product architecture and day-to-day operations.

This is a remote, hands-on individual-contributor role within Engineering. You will lead through expertise and influence, mentor engineers and security partners, and create durable systems that reduce risk while making the secure path easier.

As An Active Member Of Our Team, You Will…

Set long-term product and cloud security direction across multiple teams, shaping roadmaps, standards, secure-by-default patterns, and risk-informed design and release decisions.
Lead Product Security Reviews for distributed, multi-tenant SaaS and customer-managed products, including architecture and design review, threat modeling, abuse-case analysis, targeted secure code review, and security test planning.
Translate risk into concrete engineering requirements, mitigations, tests, and secure defaults; stay engaged through implementation and independently verify that the intended risk reduction was achieved.
Serve as a principal cloud security authority across IAM and workload identity, organization and account boundaries, network exposure, KMS and encryption, secrets, logging and detection, containers and Kubernetes, serverless services, infrastructure as code, hardening, and data isolation.
Lead the Product Security component of FedRAMP engineering. Translate FedRAMP Moderate and NIST SP 800-53 control intent into sustainable technical controls and defensible evidence, and partner on authorization-boundary and significant-change decisions, continuous monitoring, vulnerability and change management, POA&M and deviation remediation, incident response, vendor assessments, and 3PAO or assessor interactions.
Investigate ambiguous signals and vulnerabilities from bug bounty, application and supply-chain scanners, penetration tests, cloud detections, and internal reports; determine exploitability, exposure, and impact; coordinate remediation; validate fixes and bypasses; and hunt for variants and root causes.
Evolve scalable, risk-adaptive vulnerability management using exposure, exploitability, CISA Known Exploited Vulnerabilities signals, asset criticality, customer impact, and regulatory timelines,not CVSS alone.
Build and operate durable security capabilities and developer paved roads across CI/CD, SAST, SCA, secrets, infrastructure as code, containers, cloud posture, and testing. Automate repeatable work while preserving explicit human judgment for consequential security decisions.