<div class="content-intro">At Dragos, the mission is personal. The systems we protect deliver the water you drink, power your home, and keep the hospitals your community depends on running. Those critical infrastructure systems that power our civilization around the world are under attack every day by adversaries. When those systems fail, people are immediately at risk. We are the global leader in xOT cybersecurity, combining technology, threat intelligence, and expert services. The people here chose this work because they understand what is at stake. Here, you will find a remote-first mission-driven team across North America, Europe, the Middle East, and APAC built on authenticity, transparency, and trust. If safeguarding the systems that protect your family, friends, and community is the kind of work that matters to you, you are in the right place.<span class="EOP Selected SCXW107525881 BCX8" data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":120,"335559739":160,"335559740":360}"> </div>About the Role:  As a Senior OT Threat Hunter on the OT Watch team, you will serve as a key contributor to a strategic and persistent threat hunting solution designed to identify adversaries operating within customer OT networks using the Dragos Platform. The technology solution provides deep access and visibility into ICS/OT environments, and our team are expected to leverage their expertise to uncover sophisticated threats and drive measurable improvements to the overall program. OT Watch prioritizes strategic views of suspicious activities, normal events, platform detections (also known as "notifications"), and analytical responses to these activities. In this role, you will independently lead hunting operations, act as an escalation point for the broader team, and collaborate cross-functionally with Intelligence, Services and and Engineering teams to continuously elevate detection and offering capabilities. You will also serve as a trusted advisor to customers during critical security events, delivering clear and actionable guidance.  Responsibilities:  <ul> <li>Lead hands-on, hypothesis-driven threat hunts across industrial (ICS/OT) networks — working with Intelligence, R&D, and Engineering to find adversaries and uncover attack patterns others miss.</li> <li>Act as the top escalation point for high-severity alerts, guiding OT Hunters and analysts, and communicating directly with clients about critical findings, remediation steps, and technical questions.</li> <li>Configure and optimize the Dragos Platform and hunt profiles for each customer environment to catch real threats while cutting down false alarms.</li> <li>Develop new hunting hypotheses and hunt content based on real operational experience, and give structured feedback to Detection Engineering and Intelligence teams to sharpen indicators, reports, and platform outputs.</li> <li>Dig into suspicious network activity, validate what triggers alerts, and contribute to clear incident summaries and custom reports for both technical and non-technical audiences.</li> <li>Create scripts, workflows, and tooling to make hunting faster and more repeatable, while mentoring junior team members in OT protocols, adversary tactics, and threat intelligence.</li> </ul> Qualifications:  <ul> <li>Demonstrated experience in hypothesis-based threat hunting. Able to reason from an intelligence source to a testable hunt and successful investigation. </li> <li>Experience analyzing network telemetry and identifying behavioral deviations/anomalies (not solely endpoint-focused). </li> <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1">Strong understanding of networking concepts (e.g., TCP/IP, firewalls, DNS, packet analysis).</li> <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1">Experience with PCAP analysis, IDS/IPS, SIEM platforms, or other network traffic analysis tools in an OT context. </li> <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1">Deep familiarity with adversary tactics, techniques, and procedures (TTPs) relevant to OT environments, including MITRE ATT&CK for ICS. </li> <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1">Familiarity with threat intelligence workflows, including consumption and feedback loops with intelligence and detection engineering teams. </li> <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1">Proven ability to communicate complex security findings to clients and internal stakeholders, both verbally and in writing. </li> <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1">Experience acting as a technical escalation point or senior contributor in a security operations or threat hunting context.</li> <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1">Experience with ICS/OT environments is strongly preferred. </li> </ul> Compensation:  <ul> <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559683":0,"335559684":-2,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1">Salary: $140,000</li> <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559683":0,"335559684":-2,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1">Competitive Equity Package  </li> <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559683":0,"335559684":-2,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1">Comprehensive Benefits Plan </li> </ul>   #LI-JF1 #LI-REMOTE     <div class="content-conclusion">Dragos is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under federal, state, or local laws. All new hires must pass a background check as a condition of employment.</div>

Senior OT Threat Hunter

What this role actually asks for

Must have

Nice to have

Tools and technologies

The full posting

Is this one actually worth your time?