Senior Threat Detection Engineer

🔥 27 minutes ago

🇺🇸 United States – Remote

💵 $152k / year

⏰ Full Time

🟠 Senior

👷🏻‍♀️ Engineer

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Dragos, Inc.

WebsiteLinkedInAll Job Openings

501 - 1000 employees

Founded 2016

🏭 Manufacturing

📦 Logistics

💼 Consulting

💰 $74M Series D - Dragos on 2023-09

Manufacturing • Logistics • Consulting

Dragos, Inc. is a cybersecurity company specializing in operational technology (OT) and industrial control systems (ICS) protection for critical infrastructure. It provides an OT-native platform that delivers asset visibility, vulnerability management, threat detection, and response playbooks, backed by threat intelligence, managed services (including OT Watch and incident response), training, and compliance support. Dragos focuses on defending sectors like energy, utilities, manufacturing, transportation, and other industrial environments through a combination of software, intelligence, and expert services.

📋 Description

• Create ICS-focused threat detections (atomic, component, composite, and events) and Asset Identification analytics based on assigned tickets • Mentor Detection Engineers and delegate portions of detection development • Support Principal Detection Engineers through analysis of packet captures and Windows host logs • Test, validate, and tune detections for analytic quality control • Lead review, triage, and response for detection requests, enriching tickets with PCAPs, links, tags, and documentation • Document processes for authoring, validating, and testing analytics released in Dragos Platform Knowledge Packs and maintain the knowledgebase • Analyze artifacts from ICS equipment, embedded devices, firewalls, network devices, and ICS software • Support staging and artifact collection within the Dragos ICS Cyber Range • Analyze cyber threat intelligence reporting to create detection ideation tasks • Partner with Engineering, OT Watch, and Quality Engineering teams to identify protocol coverage gaps and resolve detection issues • Give and receive peer feedback as part of the review cycle

🎯 Requirements

• 8+ years in security operations, threat hunting, or detection development, OR offensive operations, threat emulation, or security tool development • 2+ years of experience operationalizing cyber threat intelligence to defend networks from emerging threats • 1+ years of direct experience with SCADA, DCS, building automation, or other industrial control system devices and environments • Advanced network packet analysis and manipulation using tools such as Wireshark, Tshark, ngrep, tcpdump, Zeek, and Scapy • Working knowledge of Windows Event Logging fundamentals, including enabling and reviewing event logs, adjusting log size and retention settings, and enabling Advanced Audit Policies • Awareness of common operating system internals and the ability to identify analytic opportunities • Comfortable working with multi-gigabyte host and network datasets • Applied knowledge of network communication fundamentals • Proven ability to mentor and develop junior detection engineers • Adept at both verbal presentation and technical writing • Experience creating detections using technologies such as Suricata, Snort, YARA, or Zeek • Prior experience producing cyber threat intelligence reports or working with threat intelligence to understand and counter adversary operations • Development experience with Python, Rust, Ruby, Go, or Lua • Experience with SOC platforms such as Splunk or Elasticsearch, including the ECS schema • Experience incorporating AI tools, models, or services into detection engineering workflows • Prior experience with ICS network assessments or ICS penetration testing • Windows and Linux system administration, networking and firewalls, and virtualization experience • Cybersecurity certifications such as SANS GICSP, GRID, GCTI, GCIA, GCIH, or GCDA; Offensive Security OSCP, OSEP, or OSED; CompTIA CySA+ or PenTest+; or similar • Ability to travel less than 10% for internal team activities, conferences, and customer sites • Must pass a background check as a condition of employment

🏖️ Benefits

• Competitive Equity Package • Comprehensive Benefits Plan • Remote-first work environment • Equal Opportunity Employer • Background check required as a condition of employment

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume