Lead Adversary Hunter for ICS/OT Threat Intelligence Remote

Dragos, Inc.; United States; On-site; USD 148,750 - 201,250; Full time

Job summary

Dragos, Inc. is seeking an expert-level Adversary Hunter for the Threat Intelligence team. You’ll independently own Threat Groups and TATs, author WorldView reports, and present findings at briefings and industry events.

This remote-first, high-autonomy role emphasizes mentorship, tooling development, and proactive threat hunting across ICS/OT environments, with opportunities to publish and influence Dragos' analytical tradecraft.

Qualifications

• 5+ years in threat intelligence with ICS/OT focus.
• Ability to independently own and publish finished intelligence products.
• Expert use of Diamond Model, Kill Chain, and MITRE ATT&CK for ICS.
• Proficiency with NetFlow, Censys, Shodan, VirusTotal, Joe Sandbox.
• Experience leading threat hunting during live incident response.
• Ability to develop tooling with Python or C# to automate workflows.
• Strong written communication and external sharing record.

Responsibilities

• Provide expert-level coverage for one or more Threat Groups and TATs, independently authoring WorldView reports and representing the team as a subject matter expert in Year in Review publications, customer briefings, webinars, and sales engagements.
• Champion cross-team collaboration to reduce stovepiping and proactively support WorldView triage and reporting pipelines, ensuring intelligence flows efficiently across functions.
• Enhance and document analysis methodologies while independently tracking new Threat Groups and TATs beyond assigned scope as intelligence needs evolve.
• Demonstrate proficiency in network telemetry tools and file-based analysis platforms to conduct advanced threat hunting and adversary infrastructure tracking.
• Leverage Synapse and Storm Query Language for advanced data modeling, threat hunting, and investigative workflows; identify automation opportunities to scale team output.
• Lead threat hunting during incident response engagements and provide advanced analytical support during surge incidents, operating with minimal oversight.
• Serve as a recognized data and tooling SME within the team, driving knowledge transfer and elevating peers.

Skills

Threat intelligence

Adversary tracking

ICS/OT knowledge

Threat hunting

Python/C# tooling

Publications/presentations

Tools

NetFlow

Censys

Shodan

VirusTotal

Joe Sandbox

Synapse

Storm Query Language

Job description

Dragos, Inc. is seeking an expert-level Adversary Hunter for the Threat Intelligence team. You’ll independently own Threat Groups and TATs, author WorldView reports, and present findings at briefings and industry events.

This remote-first, high-autonomy role emphasizes mentorship, tooling development, and proactive threat hunting across ICS/OT environments, with opportunities to publish and influence Dragos' analytical tradecraft.