Senior Threat Detection Engineer

Dragos, Inc.

. Create ICS-focused threat detections (atomic, component, composite, and events) and Asset Identification analytics based on assigned tickets .

Posted 11/4/2026full-timeRemote • United StatesSenior💰 $152,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in threat detection and analysis within industrial control systems, leveraging advanced network packet analysis and cyber threat intelligence to enhance security operations. Proven ability to mentor junior engineers and collaborate across teams to improve detection methodologies and processes.

Highest-signal resume keywords

Threat Detection DevelopmentNetwork Packet AnalysisSCADA Systems ExperienceCyber Threat Intelligence OperationalizationCybersecurity Certifications

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat DetectionNetwork Packet AnalysisSCADA SystemsDetection TechnologiesPython DevelopmentWindows Event LoggingLinux AdministrationNetwork Communication FundamentalsAI Tools IntegrationCyber Threat Intelligence Reporting

Soft Skills

MentoringTechnical WritingVerbal Presentation

Tools & Technologies

WiresharkSplunkElasticsearchSuricataSnortYARAZeekTsharkTcpdumpScapy

Certifications & Qualifications

SANS GICSPSANS GRIDSANS GCTISANS GCIASANS GCIHSANS GCDAOffensive Security OSCPOffensive Security OSEPOffensive Security OSEDCompTIA CySA+

Industry Keywords

ICS CybersecurityThreat HuntingSecurity OperationsIndustrial Control SystemsCybersecurity

Tech Stack

Tools & technologies

Cyber SecurityElasticSearchFirewallsLinuxLuaPythonRubyRustSplunkGo

About the role

Key responsibilities & impact

Create ICS-focused threat detections (atomic, component, composite, and events) and Asset Identification analytics based on assigned tickets
Mentor Detection Engineers and delegate portions of detection development
Support Principal Detection Engineers through analysis of packet captures and Windows host logs
Test, validate, and tune detections for analytic quality control
Lead review, triage, and response for detection requests, enriching tickets with PCAPs, links, tags, and documentation
Document processes for authoring, validating, and testing analytics released in Dragos Platform Knowledge Packs and maintain the knowledgebase
Analyze artifacts from ICS equipment, embedded devices, firewalls, network devices, and ICS software
Support staging and artifact collection within the Dragos ICS Cyber Range
Analyze cyber threat intelligence reporting to create detection ideation tasks
Partner with Engineering, OT Watch, and Quality Engineering teams to identify protocol coverage gaps and resolve detection issues
Give and receive peer feedback as part of the review cycle

Requirements

What you’ll need

8+ years in security operations, threat hunting, or detection development, OR offensive operations, threat emulation, or security tool development
2+ years of experience operationalizing cyber threat intelligence to defend networks from emerging threats
1+ years of direct experience with SCADA, DCS, building automation, or other industrial control system devices and environments
Advanced network packet analysis and manipulation using tools such as Wireshark, Tshark, ngrep, tcpdump, Zeek, and Scapy
Working knowledge of Windows Event Logging fundamentals, including enabling and reviewing event logs, adjusting log size and retention settings, and enabling Advanced Audit Policies
Awareness of common operating system internals and the ability to identify analytic opportunities
Comfortable working with multi-gigabyte host and network datasets
Applied knowledge of network communication fundamentals
Proven ability to mentor and develop junior detection engineers
Adept at both verbal presentation and technical writing
Experience creating detections using technologies such as Suricata, Snort, YARA, or Zeek
Prior experience producing cyber threat intelligence reports or working with threat intelligence to understand and counter adversary operations
Development experience with Python, Rust, Ruby, Go, or Lua
Experience with SOC platforms such as Splunk or Elasticsearch, including the ECS schema
Experience incorporating AI tools, models, or services into detection engineering workflows
Prior experience with ICS network assessments or ICS penetration testing
Windows and Linux system administration, networking and firewalls, and virtualization experience
Cybersecurity certifications such as SANS GICSP, GRID, GCTI, GCIA, GCIH, or GCDA; Offensive Security OSCP, OSEP, or OSED; CompTIA CySA+ or PenTest+; or similar
Ability to travel less than 10% for internal team activities, conferences, and customer sites
Must pass a background check as a condition of employment

Benefits

Comp & perks

Competitive Equity Package
Comprehensive Benefits Plan
Remote-first work environment
Equal Opportunity Employer
Background check required as a condition of employment