Cribl Application Support Engineer - REMOTE

Frisco, Texas (United States) Overview In this role you will provide L2/L3 production support for the Cribl platform (primarily Cribl Stream) and maintain its health across Leader and Worker nodes. You will troubleshoot data-flow, connectivity, and log reception issues while coordinating with cross-functional teams to sustain production security and observability. The position offers hands-on platform administration, incident handling, and integration work with Splunk, Elastic, Kafka, and cloud logging services. It's a hands-on role in a fast-moving, collaboration-driven environment with on-call responsibilities and opportunities to shape enterprise-scale observability workflows. Compensation / Benefits medical, dental, and vision insurance with employer contribution flexible spending or health savings account life and AD&D insurance short and long term disability paid time off 401k with company match Responsibilities Provide L2/L3 production support and administration for the Cribl platform (Cribl Stream) Monitor Cribl Leader Nodes, Worker Nodes, Worker Groups, Sources, Destinations, Routes, Pipelines, and overall health Troubleshoot Cribl app/service failures, data-flow, and connectivity issues Investigate missing/delayed/log-routing issues and ensure correct delivery Configure/trace Sources, Destinations, Routes, Pipelines, Packs, and Functions Perform service start/stop, configuration changes, deployments, maintenance, and health checks Investigate alerts and incidents using Cribl logs, dashboards, and OS logs Conduct RCA for recurring or critical incidents Support installation, configuration, patching, upgrades, and maintenance of Cribl Troubleshoot Linux/Unix, networking, resources, and system performance Troubleshoot TCP/IP, DNS, ports, firewall, certificates, SSL/TLS connectivity Monitor data throughput, queues, backpressure, and performance issues Support integrations with Splunk, Elastic, Kafka, Syslog, Microsoft Sentinel, AWS, Azure, and other SIEM/observability platforms Write/maintain Shell/Python scripts for monitoring, health checks, and automation Use Regex, JSON, and JavaScript for log parsing and data transformations Handle ITSM tickets (incident, change, problem, service requests) Maintain SOPs, runbooks, and operational documentation Participate in on-call/production support and major incident troubleshooting Coordinate with infrastructure, network, security, SIEM/observability, and Cribl/vendor teams Coordinate with Cribl/vendor for complex product-level issues Key requirements Cribl Stream: 5+ years in administration, configuration, monitoring, troubleshooting Cribl Components: 5+ years on Leader Nodes, Worker Nodes, Worker Groups, Sources, Destinations, Routes, Pipelines, Packs Log/Data Processing: 5+ years of log ingestion, routing, filtering, parsing, transformation, enrichment, troubleshooting Linux/Unix: 5+ years CLI and system troubleshooting Shell Scripting: 5+ years Bash/Korn shell scripting and automation Python: 5+ years basic-to-intermediate scripting for support automation Regex/JSON: 5+ years log parsing, data extraction and troubleshooting JavaScript: 5+ years for Cribl functions and data transformations Networking: 5+ years TCP/IP, DNS, ports, firewall, SSL/TLS connectivity troubleshooting SIEM/Observability: 5+ years with Splunk, Elastic, Sentinel or similar platforms ITSM: 5+ years incident/change/problem/service request management Cribl Stream administration Splunk Elastic Stack Kafka Syslog Microsoft Sentinel