Jobs at Dragos

Serve as a technical bridge between Dragos and federal customers by understanding mission requirements, designing cybersecurity solutions, conducting demonstrations, supporting sales activities, managing proof-of-concept deployments, troubleshooting issues, and responding to proposals and technical inquiries. The role requires federal procurement knowledge, cybersecurity and ICS/OT expertise, active Top Secret clearance, and regular travel up to 50%.

Leads Dragos Public Sector’s post-sales technical team, mentoring subject matter experts and driving customer adoption, operationalization, and measurable platform value. The role manages customer escalations, stakeholder relationships, product feedback, roadmap advocacy, team processes, performance metrics, and AI-enabled improvements. It requires industrial cybersecurity expertise, SIEM experience, advanced network traffic analysis, U.S. citizenship, and willingness to travel up to 25%.

Conduct early-stage product demonstrations and technical discovery for prospective customers. Partner with business development, marketing, account teams, and senior solution architects to qualify opportunities, provide consultative OT security recommendations, answer product and services inquiries, and maintain demo content, datasets, and lab environments. Share customer insights with product, marketing, and engineering teams. Travel may be required up to 15%.

Lead OT security monitoring and triage operations, investigate suspicious activity across industrial networks, tune detections, manage vulnerabilities and asset classification, and escalate findings to incident responders and threat hunters. Produce customer-facing reports, support platform operations, mentor analysts, and collaborate across cybersecurity teams. The role requires shift-based coverage, remote coordination, and expertise in network security with a strong interest in ICS/OT environments.

Leads accounting operations for Dragos Public Sector, including financial close, reporting, revenue recognition, government contract compliance, audits, internal controls, timekeeping, billing, and accounting systems administration. Partners on budgeting and forecasting, manages accounting staff, supports tax and regulatory filings, and drives process improvements across a multi-entity environment.

Manage FP&A activities including headcount reporting, annual operating planning, rolling forecasts, variance analysis, financial modeling, sales and revenue forecasting, and budget-to-actual reviews. Provide analytical insights and decision support to operational leaders, partner cross-functionally on company initiatives, and communicate business drivers, KPIs, and financial results to stakeholders.

Owns the Dragos Platform’s release architecture, packaging, documentation, communications, and delivery across on-premises, cloud-hosted, customer-hosted, and hybrid environments. Manages cloud vendor relationships, coordinates release mechanisms and schedules, develops reference architectures, and partners with Engineering, Product Marketing, Support, Customer Success, and customers to prioritize deployment capabilities and ensure reliable releases.

Leads and mentors a product security engineering team while remaining hands-on. Owns certification, accreditation, DISA STIG hardening, SOC 2, ISO 27001, audit readiness, vulnerability remediation, security tooling, and authorization initiatives. Coordinates with Compliance, Legal, Sales Engineering, and customers; tracks remediation SLAs and certification posture; establishes evidence collection processes; and translates technical security strategy into an executable roadmap.

Leads OT incident response investigations as Incident Commander, including triage, threat hunting, compromise assessments, root-cause analysis, and customer advisory work. Develops incident response plans, playbooks, maturity assessments, and tabletop exercises; manages customer relationships and communications; contributes to threat research and thought leadership; mentors responders and improves IR methodologies. The role requires extensive ICS/OT cybersecurity, digital forensics, consulting, incident management, and communication experience.

Lead large-scale Linux sensor platform initiatives for high-performance OT and ICS network monitoring. Design and improve packet ingestion, capture pipelines, queue management, broker integration, observability, and reliability. Own production root cause analysis, postmortems, performance benchmarks, and durable fixes. Translate business goals into technical plans, establish engineering standards, mentor team members, and guide architecture across the sensor codebase.

Build and maintain lead-to-order business systems across Salesforce and connected platforms. Design complex applications, declarative automation, Apex and Lightning solutions, integrations, APIs, data models, and security controls. Remediate technical debt, lead migrations and tool rollouts, manage testing and cutovers, and ensure production systems are observable, documented, and governed. Partner cross-functionally to translate business requirements into scalable solutions while supporting AI capabilities in go-to-market workflows.

Develop and validate high-fidelity threat detections and asset-identification analytics for industrial control system environments. Analyze threat intelligence, packet captures, host logs, network and device artifacts, and large datasets to identify adversary behaviors. Mentor detection engineers, review and triage detection requests, document analytics processes, and partner with engineering and quality teams to address platform gaps. Support ICS cyber-range activities and contribute to detection testing, tuning, and knowledge-base maintenance.

Designs and manages scalable data pipelines, contracts, transformation layers, and analytics models. The role focuses on data governance, observability, lineage, configuration validation, and collaboration with product engineering teams. It requires processing large datasets, integrating cloud and on-premises industrial technologies, and implementing streaming and message-queuing solutions, ideally in cybersecurity or industrial environments.

Design and maintain data pipelines, models, and transformation layers for analytics. Build data contracts, observability and lineage tooling, collaborate with product engineering, and optimize data structures for performance and scalability.

Lead and grow a data engineering team building and modernizing the core data platform for cybersecurity products. Define technical strategy and data models, ensure data quality for detection and analytics, champion AI-assisted engineering, oversee production support and incident response, collaborate with cross-functional teams, and drive hiring and best practices to deliver scalable, high-performance data pipelines and storage.

Design and implement scalable data integrations and transformation layers for cybersecurity products. Build data contracts, dimensional/incremental models, observability, and lineage tooling. Collaborate with product engineering to integrate SIEMs (Sentinel, Splunk) and deploy cloud/on-prem solutions on Kubernetes/Docker, processing medium-to-large datasets and stream/message systems.

Lead and grow the Backend Engineering team building microservice-based platform components for streaming data ingest, detection processing, baseline learning, asset reconciliation, and core platform APIs. Mentor engineers, collaborate with tech leads and product managers, provide technical design input, support production deployments, and occasionally contribute to development and troubleshooting.

Design, build, and deploy production-grade ML systems for ICS/xOT cybersecurity, including threat detection, anomaly detection, NLP/LLM applications, and scalable data pipelines with observability and MLOps practices for cloud and on-prem environments.

Lead design and modernization of scalable, secure data systems and real-time pipelines for xOT cybersecurity. Create data contracts, observability, lineage, and cross-functional solutions supporting cloud and on-prem deployments, Kubernetes, and stream processing to enable threat detection and intelligence.

Design, build, and deploy production ML systems for ICS/xOT cybersecurity, including threat detection, anomaly detection, NLP/LLM features, data pipelines, observability, MLOps, and containerized deployments across cloud and on-prem environments.