The posting, in Dragos's own words
archived Sep 8, 2026At Dragos, the mission is personal. The systems we protect deliver the water you drink, power your home, and keep the hospitals your community depends on running. Those critical infrastructure systems that power our civilization around the world are under attack every day by adversaries. When those systems fail, people are immediately at risk. We are the global leader in xOT cybersecurity, combining technology, threat intelligence, and expert services. The people here chose this work because they understand what is at stake . Here, you will find a remote-first mission-driven team across North America, Europe, the Middle East, and APAC built on authenticity, transparency, and trust. If safeguarding the systems that protect your family, friends, and community is the kind of work that matters to you, you are in the right place.
About the Role :
Our Threat Intelligence team is seeking an expert-level Adversary Hunter to serve as a recognized authority in tracking and disrupting threats targeting ICS/OT environments. In this autonomous role, you'll independently own one or more Threat Groups and Temporary Activity Threats (TATs), author authoritative intelligence products, and shape our analytical tradecraft. You'll lead proactive and reactive threat hunting engagements, collaborate across functions, and represent Dragos externally through publications, customer briefings, and industry events. As both a technical operator and force multiplier, you'll advance our data and tooling capabilities while elevating team expertise through mentorship and knowledge sharing. This is a role designed for a seasoned professional who operates with high autonomy, drives methodology development, and operates as a recognized subject matter expert.
Read the full posting ↓
Responsibilities :
Provide expert-level coverage for one or more Threat Groups and TATs, independently authoring WorldView reports and representing the team as a subject matter expert in Year in Review (YIR) publications, customer briefings, webinars, and sales engagements. Champion cross-team collaboration to reduce stovepiping and proactively support WorldView triage and reporting pipelines, ensuring intelligence flows efficiently across functions. Enhance and document analysis methodologies while independently tracking new Threat Groups and TATs beyond assigned scope as intelligence needs evolve. Demonstrate proficiency in network telemetry tools (e.g., NetFlow, Censys, Shodan) and file-based analysis platforms (e.g., VirusTotal, Joe Sandbox) to conduct advanced threat hunting and adversary infrastructure tracking. Leverage Synapse and Storm Query Language for advanced data modeling, threat hunting, and investigative workflows; continuously improve data interrogation tooling and identify automation opportunities to scale team output. Lead threat hunting efforts during incident response engagements and provide advanced analytical support during high-priority surge incidents (e.g., PIPEDREAM-class events), operating with minimal oversight. Serve as a recognized data and tooling subject matter expert within the team, driving knowledge transfer initiatives and elevating the analytical capabilities of peers and junior analysts.
Qualifications :
5+ years of experience in threat intelligence, adversary tracking, intrusion analysis, or threat hunting, with demonstrated depth in ICS/OT-focused threat activity. Proven ability to independently own and author finished intelligence products, including WorldView reports, YIR contributions, and customer-facing deliverables with minimal oversight. Expert-level application of the Diamond Model, Kill Chain stages, and MITRE ATT&CK for ICS across complex, multi-stage intrusion investigations. Hands-on proficiency with network telemetry tools (NetFlow, Censys, Shodan), file analysis platforms (VirusTotal, Joe Sandbox), and advanced working knowledge of Synapse and Storm Query Language for threat modeling and hunting automation. Experience leading or significantly contributing to threat hunting operations during live incident response engagements, including high-tempo surge events. Demonstrated ability to develop software tooling or analytical automation using Python, C#, or similar languages to enhance team workflows. Strong analytical and written communication skills, with an external presence or track record of knowledge sharing through publications, conference presentations, webinars, or industry engagement.