Associate Principal Incident Responder

This is a fully remote position, open to applicants in Germany.

📋 Description

• Lead incident response activities for industrial clients, both onsite and remotely, encompassing investigations, threat hunts, triage, and compromise evaluations.

• Act as the Incident Commander during ongoing incidents, providing decision-support guidance and managing communications throughout the incident response process.

• Drive investigations to completion across industrial settings, performing root-cause analysis and developing containment and remediation strategies, with participation in the on-call rotation.

• Conduct after-action reviews and incorporate lessons learned into playbooks and procedures.

• Facilitate incident response planning workshops, tabletop exercises, and maturity assessments that align with business risks.

• Mentor colleagues and serve as a technical escalation point, while maintaining accountability for the quality, timeliness, and utilization of deliverables.

• Cultivate customer relationships and enhance Dragos services through stakeholder engagement, research, thought leadership, and contributions to service offerings and delivery models.

• Represent Dragos as a thought leader and enhance methodologies for incident response.

⛳️ Requirements

• Must be a resident of Germany.

• Fluent in German and possess a working proficiency in English.

• Over 8 years of practical experience in incident response and digital forensics, with a lead-level scope and depth in at least two areas: network, hardware (controllers/instrumentation), memory, or disk forensics.

• Demonstrated ability to lead comprehensive investigations, correlating events across various data types to identify threats, track malicious activities, and coordinate communications during incidents.

• Experience in ICS/OT cybersecurity, including knowledge of industrial architecture, threat landscapes, vulnerabilities, and relevant frameworks and standards.

• Experience in industrial settings (as an asset owner, operator, integrator, or consultant), with the capacity to provide advice at both technical and enterprise strategy levels.

• Consulting or advisory background, translating technical expertise into strategic guidance, with exceptional written and verbal communication skills, including customer-facing documentation, playbooks, executive briefings, and composed leadership during high-pressure situations.

• Familiarity with the European and German OT regulatory landscape: NIS2, IT-SiG 2.0, BSI KRITIS, IEC 62443, and NIST CSF.

• Willingness to travel up to 40% (both domestically and internationally) to support client engagements.

• Must successfully complete a background check as a condition of employment.

🏝️ Benefits

• Competitive Equity Package.

• Comprehensive Benefits Plan.