Senior Threat Detection Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop threat detection strategies focused on ICS (atomic, component, composite, and events) and perform Asset Identification analytics according to assigned tickets.

• Guide Detection Engineers and assign tasks related to detection development.

• Assist Principal Detection Engineers by analyzing packet captures and Windows host logs.

• Validate, test, and fine-tune detections to ensure high analytic quality control.

• Oversee the review, triage, and response process for detection requests, enhancing tickets with PCAPs, links, tags, and comprehensive documentation.

• Create documentation for processes involved in authoring, validating, and testing analytics released in Dragos Platform Knowledge Packs, while also maintaining the knowledgebase.

• Examine artifacts from ICS hardware, embedded devices, firewalls, network devices, and ICS software.

• Assist in staging and artifact collection within the Dragos ICS Cyber Range.

• Review cyber threat intelligence reports to generate detection ideation tasks.

• Collaborate with Engineering, OT Watch, and Quality Engineering teams to identify and address protocol coverage gaps and detection issues.

• Participate in peer feedback as part of the review process.

⛳️ Requirements

• Minimum of 8 years of experience in security operations, threat hunting, or detection development, OR in offensive operations, threat emulation, or security tool development.

• At least 2 years of experience in applying cyber threat intelligence to protect networks against emerging threats.

• Over 1 year of hands-on experience with SCADA, DCS, building automation, or other industrial control system devices and environments.

• Proficient in advanced network packet analysis and manipulation using tools such as Wireshark, Tshark, ngrep, tcpdump, Zeek, and Scapy.

• Solid understanding of Windows Event Logging fundamentals, including the ability to enable and review event logs, adjust log size and retention settings, and activate Advanced Audit Policies.

• Familiarity with common operating system internals and the capability to spot analytic opportunities.

• Comfortable handling multi-gigabyte datasets related to hosts and networks.

• Applied knowledge of network communication principles.

• Demonstrated ability to mentor and develop junior detection engineers.

• Proficient in both verbal presentations and technical writing.

• Experience in creating detections utilizing technologies such as Suricata, Snort, YARA, or Zeek.

• Previous experience in producing cyber threat intelligence reports or working with threat intelligence to comprehend and counter adversary operations.

• Development experience in Python, Rust, Ruby, Go, or Lua.

• Familiarity with SOC platforms like Splunk or Elasticsearch, including knowledge of the ECS schema.

• Experience integrating AI tools, models, or services into detection engineering processes.

• Prior involvement in ICS network assessments or ICS penetration testing.

• Proficient in Windows and Linux system administration, networking, firewalls, and virtualization.

• Possession of cybersecurity certifications such as SANS GICSP, GRID, GCTI, GCIA, GCIH, or GCDA; Offensive Security OSCP, OSEP, or OSED; CompTIA CySA+ or PenTest+; or similar certifications.

• Willingness to travel less than 10% for internal team activities, conferences, and customer locations.

• Must successfully pass a background check as a requirement of employment.

🏝️ Benefits

• Competitive Equity Package.

• Comprehensive Benefits Plan.

• Remote-first work environment.

• Equal Opportunity Employer.

• Background check required as a condition of employment.