Senior Cyber Threat Intelligence Analyst

This is a fully remote position, open to applicants in Australia.

📋 Description

• Provide direct support to the client regarding ICS/OT cyber threat intelligence requirements, particularly during critical situations that involve national security priorities, while establishing credibility to influence priorities instead of merely responding to requests.

• Conduct ICS/OT CTI research, analysis, and threat hunting utilizing both proprietary and commercial resources, executing both freeform and hypothesis-driven hunts by examining network traffic and industrial protocols to identify anomalous activities.

• Assist the client in establishing a baseline of OT asset and network behaviors through the use of the Dragos Platform, Synapse, and other complementary tools to verify and prioritize leads.

• Contextualize ICS/OT threats and risks pertinent to the client’s objectives, offer recommendations on best practices and mitigation strategies, and cultivate in-depth expertise in threats unique to the client's OT landscape.

• Convert technical hunting findings into MITRE ATT&CK for ICS mappings and confidence-based evaluations that can be acted upon by non-technical stakeholders.

• Aid the client during incident response engagements and exercises.

• Create industry-specific technical and strategic ICS/OT CTI content and provide constructive feedback to internal Dragos teams to enhance the impact of intelligence across the organization.

⛳️ Requirements

• At least 4 years of experience in cyber threat intelligence utilizing various data sources (e.g., NetFlow, open-source intelligence, SIEMs, malware repositories) to produce analytical products.

• Practical experience in threat hunting, including the analysis of packet captures and inspection of industrial protocols.

• Strong practical expertise in both freeform and hypothesis-driven threat hunting techniques.

• Experience in a customer-facing role with a proven ability to manage stakeholders independently and effectively.

• Excellent technical and strategic writing abilities for creating CTI analytical products, including confidence-based assessments and threat modeling frameworks (such as the Diamond Model of Intrusion Analysis).

• Proficient in data aggregation, hunting, and analysis tools (e.g., Synapse) and experienced in utilizing AI/LLM resources within CTI workflows.

• Extensive knowledge of ICS/OT threats across various industrial sectors, including adversary TTPs, historical attacks, relevant technologies (PLCs, HMIs, RTUs), and network protocols and topologies.

• Capability to independently scope, develop, and deliver CTI analysis utilizing industry frameworks (MITRE ATT&CK for ICS, D3FEND, ICS Cyber Kill Chain).

• All new hires are required to pass a background check as a condition of employment.

🏝️ Benefits

• Competitive Equity Package

• Comprehensive Benefits Plan