Senior Threat Detection Engineer

Senior engineer on Dragos's Detection Engineering team, turning intelligence about threats to industrial control systems into high-fidelity detections for the Dragos Platform. The role is remote in the US with under 10 percent travel.

The engineer builds atomic, component and composite ICS detections and asset identification analytics, mines threat intelligence reporting for new detection ideas, tests and tunes rules from colleagues and partners, analyses packet captures, Windows logs and artifacts from ICS equipment and the Dragos ICS Cyber Range, runs the detection support queue, documents processes and mentors junior engineers. Dragos wants eight or more years in security operations, hunting, detection or offensive work, two or more operationalising threat intelligence, at least a year with SCADA, DCS or other ICS environments, and advanced packet analysis with tools like Wireshark, Zeek and Scapy.