Jobs at Dragos

Lead hypothesis-driven threat hunts across industrial control system and operational technology networks. Investigate suspicious activity, escalate high-severity alerts, configure Dragos Platform hunt profiles, develop hunting content, analyze network telemetry, and improve detection capabilities. Advise customers during critical security events, produce technical reports, create repeatable tooling, and mentor junior team members on OT protocols, adversary tactics, and threat intelligence.

Own end-to-end delivery of technical IT projects from intake and procurement through deployment and closeout. Manage SaaS rollouts, system integrations, requirements, vendor milestones, security reviews, testing, go-live, risks, dependencies, and stakeholder communications. Maintain project plans and reporting in Jira and Confluence, enforce lifecycle handoffs, manage change control, and report portfolio health. Improve delivery processes through templates, automation, intake criteria, and standardized reporting while coordinating Procurement, Engineering, IT Security, vendors, and business stakeholders.

Serve as the primary technical advisor for federal customers using the Dragos OT cybersecurity platform. Lead onboarding, implementation, adoption, account reviews, roadmap alignment, optimization, customer health monitoring, and recovery plans. Partner with Customer Success, Support, Product, and Sales while delivering cybersecurity training, workshops, and executive briefings. Apply ICS/OT expertise to help customers operationalize security use cases, improve maturity, mitigate risk, and achieve measurable value.

Lead large-scale Linux sensor platform initiatives for high-performance OT and ICS network monitoring. Design and improve packet ingestion, capture pipelines, queue management, broker integration, observability, and reliability. Own production root cause analysis, postmortems, performance benchmarks, and durable fixes. Translate business goals into technical plans, establish engineering standards, mentor team members, and guide architecture across the sensor codebase.

Build and maintain lead-to-order business systems across Salesforce and connected platforms. Design complex applications, declarative automation, Apex and Lightning solutions, integrations, APIs, data models, and security controls. Remediate technical debt, lead migrations and tool rollouts, manage testing and cutovers, and ensure production systems are observable, documented, and governed. Partner cross-functionally to translate business requirements into scalable solutions while supporting AI capabilities in go-to-market workflows.

Own Tier 3 escalations and incident response for complex customer issues involving a cybersecurity platform. Investigate distributed systems, reproduce defects, coordinate resolutions with engineering and product teams, and build Datadog observability dashboards, monitors, and alerts. Create runbooks, troubleshooting guides, RCAs, and postmortems; mentor support staff; identify recurring failure patterns; communicate with customers; and participate in an application-layer on-call rotation.

Lead partner marketing strategy and execution to drive sourced and influenced pipeline. Manage MDF, co-marketing, ABM-aligned partner programs, enablement assets, partner engagement, and measurement in collaboration with demand generation, field marketing, and partner teams.

Develop and validate high-fidelity threat detections and asset-identification analytics for industrial control system environments. Analyze threat intelligence, packet captures, host logs, network and device artifacts, and large datasets to identify adversary behaviors. Mentor detection engineers, review and triage detection requests, document analytics processes, and partner with engineering and quality teams to address platform gaps. Support ICS cyber-range activities and contribute to detection testing, tuning, and knowledge-base maintenance.

Designs and manages scalable data pipelines, contracts, transformation layers, and analytics models. The role focuses on data governance, observability, lineage, configuration validation, and collaboration with product engineering teams. It requires processing large datasets, integrating cloud and on-premises industrial technologies, and implementing streaming and message-queuing solutions, ideally in cybersecurity or industrial environments.

Design and maintain data pipelines, models, and transformation layers for analytics. Build data contracts, observability and lineage tooling, collaborate with product engineering, and optimize data structures for performance and scalability.

Oversee indirect tax compliance across multiple jurisdictions, including Sales & Use, VAT, GST, and gross receipts filings. Reconcile tax liability accounts, prepare journal entries, support audits, manage exemption certificates, and maintain Avalara tax software integrated with the ERP system. Research tax issues related to business expansion and product launches, manage service providers, improve processes, and collaborate with finance and cross-functional teams to meet compliance deadlines.

Plans, deploys, configures, and supports the Dragos Platform in customer industrial environments. Designs network architecture and sensor placement, leads onsite and remote implementations, troubleshoots integrations, manages upgrades and patches, supports ICS/OT security operations, collaborates on investigations, and produces technical documentation. The role requires strong networking, Linux, scripting, SIEM, cloud, and industrial cybersecurity expertise, an active Secret clearance, and up to 30% travel.

Lead and grow a data engineering team building and modernizing the core data platform for cybersecurity products. Define technical strategy and data models, ensure data quality for detection and analytics, champion AI-assisted engineering, oversee production support and incident response, collaborate with cross-functional teams, and drive hiring and best practices to deliver scalable, high-performance data pipelines and storage.

Design and implement scalable data integrations and transformation layers for cybersecurity products. Build data contracts, dimensional/incremental models, observability, and lineage tooling. Collaborate with product engineering to integrate SIEMs (Sentinel, Splunk) and deploy cloud/on-prem solutions on Kubernetes/Docker, processing medium-to-large datasets and stream/message systems.

Lead and grow the Backend Engineering team building microservice-based platform components for streaming data ingest, detection processing, baseline learning, asset reconciliation, and core platform APIs. Mentor engineers, collaborate with tech leads and product managers, provide technical design input, support production deployments, and occasionally contribute to development and troubleshooting.

Design, build, and deploy production-grade ML systems for ICS/xOT cybersecurity, including threat detection, anomaly detection, NLP/LLM applications, and scalable data pipelines with observability and MLOps practices for cloud and on-prem environments.

Hunt, identify, and analyze adversary tools, malware, and tradecraft targeting ICS/OT. Develop and maintain analysis tools and scripts, contribute to threat assessments and customer advisories, leverage intel and network analysis tools, recommend automation and telemetry improvements, and support incident response and external communications.

Lead design and modernization of scalable, secure data systems and real-time pipelines for xOT cybersecurity. Create data contracts, observability, lineage, and cross-functional solutions supporting cloud and on-prem deployments, Kubernetes, and stream processing to enable threat detection and intelligence.

Design and maintain data pipelines, data contracts, and transformation layers for analytics. Model complex sources, enable observability and lineage, collaborate with product teams, and optimize data structures for scalable cybersecurity and industrial datasets.

Design, build, and deploy production ML systems for ICS/xOT cybersecurity, including threat detection, anomaly detection, NLP/LLM features, data pipelines, observability, MLOps, and containerized deployments across cloud and on-prem environments.