security analyst in OT cybersecurity

Dragos is a global leader in xOT cybersecurity, combining technology, threat intelligence, and expert services to protect critical infrastructure systems.

• Lead shift operations and guide analysts as they triage detection alerts and network telemetry across customer OT environments; step in as regional shift leader when needed
• Investigate suspicious industrial network activity to identify misconfigurations, anomalies, and potential malicious behavior
• Analyze findings and escalate them to Incident Responders and threat hunters with clear, actionable documentation
• Partner with analysts, threat hunters, incident responders, platform engineers, and Detection Engineering to tune detection logic, reduce false positives, and shape new Dragos Platform detections and playbooks
• Write and deliver incident summaries and operational reports for internal stakeholders and customers
• Support OT Watch Complete, including asset classification, vulnerability management, hardening recommendations, and customer information requests
• Build expertise in ICS/OT protocols, adversary tradecraft, and threat intelligence for industrial environments

• 3–5 Years of experience in network security, ideally with hands-on exposure to real-world threat investigation
• Solid understanding of TCP/IP, firewalls, DNS, and packet analysis
• Hands-on experience with security monitoring tools such as IDS/IPS, SIEM platforms, or network traffic analyzers
• Strong written and verbal communication skills and attention to detail; able to explain technical findings to internal teams and customers
• Genuine interest in ICS/OT cybersecurity and defending critical infrastructure, with the ability to quickly learn and apply complex industrial-specific concepts
• Comfortable working independently in a remote environment while coordinating across distributed teams
• Flexible to participate in shift-based coverage and occasional weekend/on-call work as needed
• Будет плюсом: experience on a Security Operations Center (SOC) team, familiarity with OT protocols such as Modbus, DNP3, and Ethernet/IP and ICS environments, applied knowledge of adversary tactics and OT frameworks such as MITRE ATT&CK for ICS, hands-on lab or internship experience in cybersecurity operations, threat hunting, or digital forensics, PCAP analysis, basic scripting such as Python or Bash

• Competitive Equity Package
• Comprehensive Benefits Plan
• Initial schedule: Monday-Friday 8am-5pm, with on-call weekends (MDT for US, CEST for Europe, AEST for AUS)
• The schedule will later change to a 4 day/week, 10 hour shift model, which includes a day on the weekend. Shift schedules under the 4-day schedule will run Sunday-Wednesday and Wednesday-Saturday. Applicants will have the option to pick from either of the two shift schedules (Sunday-Wednesday or Wednesday-Saturday)
• All new hires must pass a background check as a condition of employment