Senior ICSS Threat Detection Engineer – Remote-First

Dragos, Inc.; United States; On-site; USD 129,000 - 175,000; Full time

Job summary

Dragos is seeking a Senior Detection Engineer to join our Detection Engineering team, driving high-fidelity detections for OT environments and turning threat intelligence into actionable analytics.

As part of a global ICS cybersecurity leader, you will mentor junior engineers, collaborate with engineering, OT Watch, and quality teams, and help advance the Dragos Platform to identify, triage, and respond to evolving threats across critical infrastructure worldwide.

Qualifications

• 8+ years in security operations, threat hunting, or detection development.
• 2+ years operationalizing cyber threat intelligence to defend networks from emerging threats.
• 1+ years of direct experience with SCADA, DCS, building automation, or other industrial control system devices and environments.
• Advanced network packet analysis and manipulation using tools such as Wireshark, Tshark, ngrep, tcpdump, Zeek, and Scapy.
• Working knowledge of Windows Event Logging fundamentals, including enabling and reviewing event logs, adjusting log size and retention settings, and enabling Advanced Audit Policies.
• Awareness of common operating system internals and the ability to identify analytic opportunities.
• Comfortable working with multi-gigabyte host and network datasets.
• Applied knowledge of network communication fundamentals.
• Proven ability to mentor and develop junior detection engineers.
• Adept at both verbal presentation and technical writing.

Responsibilities

• Create ICSS-focused threat detections (atomic, component, composite, and events) and Asset Identification analytics based on assigned tickets.
• Mentor ICSS Detection Engineers by engaging them in your detection development process and delegating portions of detection development they are ready to own.
• Engage with Principal Detections Engineers to support their detection development initiatives through analysis of packet captures and Windows host logs.
• Test, validate, and tune detections created by the ICSS Detection team, including rules submitted by trusted advisors and industry partners, for analytic quality control.
• Lead the review, triage, and response for detection requests submitted to the ICSS Detection Support board, enriching tickets with PCAPs, links, tags, and documentation.
• Drive documentation of processes for authoring, validating, and testing analytics released in the Dragos Platform Knowledge Packs (KPs), and keep the knowledgebase current on reported issues, false positives, and detection questions.
• Analyze artifacts collected from ICSS equipment, embedded devices, firewalls, network devices, and ICSS software, and support staging and artifact collection within the Dragos ICSS Cyber Range.
• Analyze cyber threat intelligence reporting to create detection ideation tasks for threat behavior-based detections and Asset Identification.
• Partner with the Engineering, OT Watch, and Quality Engineering teams to identify protocol coverage gaps and resolve detection issues in the Dragos Platform.
• Give and receive peer feedback on a normal cadence as part of our review cycle.

Skills

Security operations

Threat hunting

Detection development

Network packet analysis

Windows Event Logging

ICSS devices

Mentoring juniors

Verbal presentation

Technical writing

Programming (Python Go Rust)

Tools

Wireshark

Tshark

Zeek

Suricata

Snort

YARA

Scapy

Splunk

Elasticsearch

ECS schema

Python

Rust

Go

Lua

Job description

Dragos is seeking a Senior Detection Engineer to join our Detection Engineering team, driving high-fidelity detections for OT environments and turning threat intelligence into actionable analytics.

As part of a global ICS cybersecurity leader, you will mentor junior engineers, collaborate with engineering, OT Watch, and quality teams, and help advance the Dragos Platform to identify, triage, and respond to evolving threats across critical infrastructure worldwide.