Associate Principal Cyber Threat Intelligence Analyst (Onsite)

Dragos is on a relentless mission to defend industrial organizations that provide us with the necessities of modern civilization; running water, functioning electricity, and safe industrial working environments. As the market leader in ICS/OT Cybersecurity, we are dedicated to arming our customers with best-in-class technology, threat intelligence, and services to protect their systems as effectively and efficiently as possible. We’re a remote-first culture with operations in North America, Europe, the Middle East, and APAC. We’re looking for mission-oriented teammates who embody our core values of authenticity, transparency, and trust. Are you ready to make a difference? Come join a mission that can save the world! 

About the Role

The Dragos Global Intelligence team is seeking a Senior Cyber Threat Intelligence Analyst to partner directly with our government customers, embedding within their security and intelligence teams to deliver highly tailored, actionable intelligence. This role involves a range of delivery formats—written reports, verbal briefings, in-person sessions, and both long-form and rapid-turnaround responses—based on customer needs. The analyst will also collaborate closely with internal delivery teams to ensure engagements generate the greatest possible intelligence value. The ideal candidate brings experience supporting customers in a service-driven environment, delivering customized cyber threat intelligence. Familiarity with industrial control systems (ICS) and prior involvement in incident response are also key to success in this role. This is an onsite position (5 days per week) that will report to a customer office in Washington DC. 

Responsibilities:

• Directly support clients with their respective ICS/OT security and cyber threat intelligence needs through proactive threat hunting across ICS/OT environments to identify malicious activity, anomalous behavior, and indicators of compromise.

• Collaborate with customer’s internal security teams to validate findings and escalate confirmed threats.

• Support the customer’s ICS/OT cyber security operationalization using the Dragos Platform.
• Leverage multiple OT CTI sources to respond to client inquiries and draft recurring deliverables tailored to your respective client’s priority intelligence requirements.
• Build and maintain a working knowledge and understanding of ICS/OT threats and risks directly relevant to your respective client’s OT environment, including attack surface analysis, threat hunting strategies, and threat modeling.
• Translate technical intelligence into operational recommendations for OT defenders and stakeholders.
• Maintain awareness of global threats to ICS/OT systems.
• Provide support and feedback to other internal Dragos teams, such as Customer Success and the broader Dragos Intelligence apparatus. 
• Report to the client’s respective facility during core operational hours.  

Requirements: 

• Must be willing to commute 5 days per week to a customer office in Washington DC. 

• Active Top Secret Security Clearance. 

• Minimum of 4 years in CTI hunting and analysis, with hands-on experience in threat hunting, research and analysis using tools and data such as NetFlow, endpoints, OSINT and incident response/forensics. 
• Minimum of 2 years in a customer-facing role (e.g., consulting or managed service provider)
• Minimum of 2 years working with ICS/OT environments, including knowledge of relevant technologies, network topology, protocols and how adversaries target and exploit them. 

Preferred Experience

• Experience with network and host-based security platforms 

• Experience with performing threat hunts within an OT environment as well as writing CTI analysis products and deliverables using confidence-based assessments.  

• Knowledge of CTI threats impacting one or more industry verticals or sectors (i.e., Oil & Natural Gas, Electric, Government, Chemicals, Manufacturing, Water, and so on).  

• Knowledge of ICS adversary TTPs, historical attacks, and the overall impact of those events.  

• Understanding of ICS/OT technology and how adversaries can exploit that technology.  

• Knowledge of cyber security and network defender frameworks such as Mitre ATT&CK and DEFEND.  

• Experience with ICS/OT network topology, standard ICS protocols, and common technologies such as PLCs, HMIs, RTUs, and EDSs.  

• Experience with data aggregation, hunting, and analysis tools such as Synapse.  

Compensation

• Salary: $155,000

• Competitive Equity Package 

• Comprehensive Benefits Plan

#LI-JF1 #LI-REMOTE

Dragos is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under federal, state, or local laws. All new hires must pass a background check as a condition of employment.