Back to jobs
Role: Practitioner Community Lead, Security
Job Type: Full Time, United States - Remote
This is not a typical marketing role. You'll split your time between three things: building a practitioner community that trusts Crogl, creating real use cases and skills inside the product, and producing the technical demo content that shows, not tells, what Crogl can do.
You'll be the most visible Crogl face to working security analysts. That means you need to be one. If you've run a SOC, built detections, fought alert fatigue, or spent nights chasing down context across five tools, this is the seat for you.
Build and manage Crogl's community presence across key forums, Slack communities, and industry groups where security analysts actually spend time.
Facilitate technical conversations where analysts share use cases, troubleshooting approaches, and detection strategies using Crogl.
Represent Crogl at industry events, conferences, and meetups (staffing the booth, running demos, engaging in real technical Q&A.)
Develop and run programs that turn early users into advocates onboard them, celebrate their wins, amplify their voices.
Develop practitioner-grade skills and use cases natively inside the Crogl, from detection workflows to investigation playbooks and everything in between.
Work directly with engineering and product to test new features, and report friction in the product.
Serve as a voice of the practitioner in product planning cycles, translating real analyst needs into clear, actionable feedback.
Assist in building and maintaining realistic demo scenarios that reflect how customers actually use the product, not sanitized marketing sandboxes.
Produce hands-on walkthroughs, and interactive content that lets prospects experience Crogl before they get their hands on it.
Write technically credible content: implementation guides, blog posts, medium articles, reddit posts, and application notes that demonstrate depth, not just awareness.
7+ years in the security or observability space in a role where you actually had to work with the data, security analyst, detection engineer, sales engineer, technical marketing engineer, professional services, or similar.
Direct hands-on experience with SIEM platforms (Splunk, CrowdStrike, SentinelOne, Microsoft Sentinel, or equivalent) and the workflows analysts use daily.
Demonstrated ability to build community, whether through content, programs, in-person events, or all of the above.
Working knowledge of common search and query languages — SPL, KQL/Kusto, or Elastic Query DSL.
Comfortable with scripting in at least one language (Python preferred) and familiar with regular expressions.
Experience with cloud infrastructure basics (AWS preferred) and containerized environments (Docker/Kubernetes).
Familiarity with CI/CD concepts, code versioning (GitHub), and automation tooling (Terraform, Ansible) is a plus.
You can write. Clearly, specifically, and without jargon when it doesn't serve the reader. You know the difference between a blog post and an implementation guide.
You're comfortable on camera and in a 1:1 technical conversation with a skeptical analyst. Same message, different register.
You have opinions about what makes security tooling actually good and you're willing to say so.
This role involves roughly 20-25% travel to conferences, field events, and team offsites. We're a remote-first company — you'll work async across time zones most of the time, with occasional off-hours availability for events or community moments that can't wait.
You'll report to the marketing leadership team and work closely with product, engineering, and the field. Your output will be visible externally — to the community, to prospects, and to customers.
We're building something that security analysts actually want to use. Not AI theater. A tool that makes the job less brutal. If you've felt the pain we're solving firsthand, and you want to be the person who helps others discover the fix, we'd like to talk.