Associate Principal Adversary Hunter

About the Role

The Threat Intelligence team is seeking an expert-level Adversary Hunter to serve as a recognized authority in tracking and disrupting threats targeting ICS/OT environments. In this autonomous role, you'll independently own one or more Threat Groups and Temporary Activity Threads (TATs), author authoritative intelligence products, and shape our analytical tradecraft. You'll lead proactive and reactive threat hunting engagements, collaborate across functions, and represent Dragos externally through publications, customer briefings, and industry events. As both a technical operator and force multiplier, you'll advance our data and tooling capabilities while elevating team expertise through mentorship and knowledge sharing.

Responsibilities

• Provide expert-level coverage for one or more Threat Groups and TATs, independently authoring WorldView reports and representing the team as a subject matter expert in Year in Review (YIR) publications, customer briefings, webinars, and sales engagements.
• Champion cross-team collaboration to reduce stovepiping and proactively support WorldView triage and reporting pipelines, ensuring intelligence flows efficiently across functions.
• Enhance and document analysis methodologies while independently tracking new Threat Groups and TATs beyond assigned scope as intelligence needs evolve.
• Leverage network telemetry tools (e.g., NetFlow, Censys, Shodan) and file-based analysis platforms (e.g., VirusTotal, Joe Sandbox) to conduct advanced threat hunting and adversary infrastructure tracking.
• Lead threat hunting efforts during incident response engagements and provide advanced analytical support during high-priority surge incidents (e.g., PIPEDREAM-class events), operating with minimal oversight.
• Serve as a recognized data and tooling subject matter expert within the team, driving knowledge transfer initiatives and elevating the analytical capabilities of peers and junior analysts.

Qualifications

• 5+ years of experience in threat intelligence, adversary tracking, intrusion analysis, or threat hunting, with demonstrated depth in ICS/OT-focused threat activity.
• Proven ability to independently own and author finished intelligence products, including WorldView reports, YIR contributions, and customer-facing deliverables with minimal oversight.
• Expert-level application of the Diamond Model, Kill Chain stages, and MITRE ATT&CK for ICS across complex, multi-stage intrusion investigations.
• Hands-on proficiency with network telemetry tools (NetFlow, Censys, Shodan), file analysis platforms (VirusTotal, Joe Sandbox), and advanced working knowledge of Synapse and Storm Query Language for threat modeling and hunting automation.
• Experience leading or significantly contributing to threat hunting operations during live incident response engagements, including high-tempo surge events.
• Demonstrated ability to develop software tooling or analytical automation using Python, C#, or similar languages to enhance team workflows.
• Strong analytical and written communication skills, with an external presence or track record of knowledge sharing through publications, conference presentations, webinars, or industry engagement.

Compensation

Salary: $175,000
Competitive Equity Package
Comprehensive Benefits Plan