Forward Deployed Solutions Lead

Why You’ll Love This Role

Cribl is seeking a Forward Deployed Engineer (FDE) to join our Professional Services organization. Cribl is the Data Engine for IT and Security, with a mission to empower enterprises to unlock the value of all their data. We’re a remote‑first company, founded in 2018 and headquartered in San Francisco, trusted by organizations worldwide including many of the Fortune 100 to manage and analyze telemetry at petabyte scale across some of the largest IT and security environments in the world.

In this role, you’ll design, build, and operate real solutions with customers, extending Cribl and embedding it into how they actually work. You’ll act as an embedded engineering partner for a small portfolio of our most strategic customers, closing the gaps between what Cribl does out of the box and what those customers need it to do in their existing tooling and workflows.

• Integrate Cribl deeply into customers’ current tools and systems so using Cribl feels natural in their world.
• Build custom search experiences and data flows that meet customer‑specific requirements — including needs that are ahead of the product roadmap or may never become core features.
• Design creative, pragmatic solutions that set customers up for success right now, while also creating patterns and assets that help them (and us) scale in the future.

This role is designed as a strategic investment: you’ll focus on solving our hardest last‑mile problems for flagship customers and turning those solutions into reusable Packs, integrations, and patterns that raise the bar for everyone.

As An Active Member Of Our Team, You Will…

• Be the embedded technical partner for key accounts:
  • Act as the embedded engineering contact for a select set of strategic customers, developing a deep understanding of their architectures, constraints, and goals.
  • Build long‑term trust by consistently delivering solutions that work in their real‑world context — not just in demos.
• Integrate Cribl into customers’ existing tooling and workflows:
  • Design and build integrations into customers’ current tools — SIEM, SOAR, EDR/XDR, identity platforms, observability stacks, cloud services, ITSM/ticketing, data lakes, and more — so Cribl becomes a natural part of how their teams operate.
  • Implement REST collectors, custom event sources and destinations, webhook handlers, and platform connectors that reduce friction and make Cribl easy to adopt and operate inside existing ecosystems.
• Customize and extend Cribl Search and data experiences:
  • Extend Cribl Search with customer‑specific datasets, knowledge objects, dashboards, saved searches, and search‑time enrichment pipelines to support their unique investigation and analytics workflows.
  • Build tailored search experiences that can mimic or improve what customers are used to in similar tools, so moving to Cribl feels like an upgrade, not a compromise.
• Bridge “today’s needs” and “future product”:
  • Work with customers whose requirements may be ahead of the product roadmap or never part of core product, and:
    • Design creative, supportable solutions using existing Cribl capabilities, Packs, and custom code.
    • Clearly distinguish between what’s covered by product vs. custom implementation, and ensure customers are set up for success both now and as the product evolves.
  • Partner with Product and Engineering to:
    • Turn repeated patterns into product‑backed features or officially supported Packs/integrations where it makes sense.
    • Provide clear, actionable feedback on APIs, extensibility, and UX based on real‑world usage.
• Build reusable assets and patterns:
  • Develop reusable Cribl Packs and solution assets that encapsulate best‑practice pipelines, event breakers, lookups, and integrations for common data sources, platforms, and architectures.
  • Contribute to internal GitHub repos, templates, and tooling that other PS consultants, CSEs, and partners can use to accelerate delivery.
• Engineer complex data and pipeline logic:
  • Use JavaScript/Node.js, regex, lookup tables, and Cribl’s processing framework to solve non‑trivial data normalization, enrichment, and routing challenges across massive, heterogeneous environments.
  • Design solutions that are maintainable, upgrade‑safe, and observable, with clear instrumentation and runbooks.
• Collaborate across Field CTOs, CSEs, and PS:
  • Partner with Field CTOs on big‑picture architectures and strategic bets for key accounts.
  • Work with Customer Success Engineers (CSEs) and Professional Services consultants on strategic programs and projects, providing the deep engineering needed to actually build and ship what the team designs.
  • Author clear design docs, runbooks, and as‑built architecture reports to make your work understandable and sustainable for customers and internal teams.
  • We are a remote-first company and work happens across many time-zones – you may be required to occasionally perform duties outside your standard working hours

If You’ve Got It - We Want It 

• 5+ years of hands‑on experience in a software engineering, solutions engineering, or forward deployed/professional services engineering role within a SaaS, cloud, or security software environment.
• Strong proficiency in JavaScript/Node.js for building pipeline logic, REST integrations, and custom Cribl functions, with solid engineering practices (testing, version control, CI/CD).
• Proven experience designing and implementing production‑grade backend services and integrations — including RESTful APIs, authentication and UI interfaces.
• Proven experience designing end‑to‑end architectures that span telemetry collection, pipelines/processing, storage (e.g., object stores, data lakes, SIEMs), and search/analytics, with clear trade‑offs around cost, performance, and reliability.
• Hands‑on experience operating in one or more major cloud providers (AWS, Azure, or GCP), including core services like IAM/permissions, networking, and object storage in production environments.
• Experience owning services or integrations in production — instrumenting them for observability, setting up alerts and runbooks, and participating in incident response or on‑call‑style rotations.
• Demonstrated ability to lead customer discovery and architecture sessions, translate ambiguous requirements into concrete technical designs, and communicate trade‑offs to both engineers and non‑technical stakeholders.
• Deep familiarity with the observability, security, and logging ecosystem — including SIEM platforms (Splunk, Sentinel, QRadar, XSIAM), log management, EDR/XDR, and cloud‑native telemetry sources.
• Solid understanding of data formats common in IT and security pipelines — JSON, syslog, CEF, LEEF, multiline logs, and custom vendor formats.
• Comfort working hands‑on in customer environments — accessing Cribl UIs, deploying configurations, validating data flows, and troubleshooting production issues.
• Strong written communication skills — able to produce clear design docs, architecture diagrams, and customer‑facing artifacts.
• A demonstrated ability to be creative under real‑world constraints: you enjoy finding pragmatic, elegant solutions when the “perfect” feature doesn’t exist yet.
• A mindset focused on setting customers up for success now and in the future — designing solutions that can evolve as their environment and our product change.
• BONUS POINTS:
• Cribl Certified Engineer (CCOE) or equivalent Cribl product expertise.
• Experience extending or building on top of search and analytics platforms
• Background in data pipeline development, security data engineering, or large‑scale log management infrastructure.
• Familiarity with containerized deployments (Docker, Kubernetes) and cloud platforms (AWS, Azure, GCP).
• Prior experience contributing to open source projects or publishing integrations, Packs, or tooling to a community marketplace.
• Exposure to enterprise MSA/SOW‑based delivery and how engineering work ties into services offerings (even if this role isn’t utilization‑driven out of the gate).
• Ability to travel occasionally for key customer workshops or team events.

#LI-KM1
#LI-Remote