Senior Manager, Adversary Hunting

About the Role:

The Senior Manager of Adversary Hunting will serve as both a technical leader and a people manager for a highly skilled team of Adversary Hunters. This team focuses on finding and tracking OT-focused adversaries wherever they operate; the primary output of their work is WorldView reporting. This is a hands-on technical role with people management responsibilities for the Adversary Hunting bench. You'll report to the Director of Adversary Hunting Operations, and work cross-functionally with Intelligence Operations, Vulnerability Research, Capabilities/Malware Analysis, and other Threat Hunting teams to translate hunting outcomes into prioritized intelligence and detection opportunities. Our ideal candidate will have prior experience tracking OT-focused threat groups and leading or mentoring technical analysts in a fast-paced intelligence production environment. 

Responsibilities: 

• Lead, mentor and develop the Adversary Hunting team, guiding coverage of OT-focused Threat Groups and Temporary Activity Threads (TATs) and fostering analytical rigor and technical excellence. 
• Serve as the primary point of contact for the Adversary Hunting team within Intelligence, aligning team priorities and daily operations with Dragos Intelligence collection requirements and WorldView reporting goals.
• Lead day-to-day hunting operations, implement and refine established methodologies, and optimize team workflows across Synapse and Storm Query Language-based investigative pipelines.
• Partner with Intelligence Operations, Vulnerability Research, and Capabilities/Malware Analysis to translate hunting outcomes into prioritized WorldView content and detection opportunities (IOCs, YARA rules).
• Deliver against and further refine key performance indicators (KPIs) for Adversary Hunting coverage, WorldView report production, and RFI response quality.
• Guide team members in delivering high-quality, timely analytical outputs, including WorldView reports, Year in Review (YIR) content, and customer- or strategic-level deliverables.
• Support recruitment, onboarding, and performance management within the Adversary Hunting team, including the development of junior managers and senior hunters.
• Direct hunting support and triage during surge events (e.g., PIPEDREAM) and incident response engagements.
• Represent the team through internal briefings and external engagements — writing blog posts, speaking at events, and engaging with practitioners through webinars, customer briefings, and social media. 

Qualifications:  

• At least 5-7 years of experience in threat intelligence, adversary tracking, threat hunting, or detection engineering; at least 2 years mentoring or providing a level of leadership to personnel.
• Demonstrated expertise tracking OT-focused Threat Groups and TATs, hypothesis-driven hunting, and producing WorldView-style intelligence reporting.
• Strong knowledge of attacker TTPs and common frameworks used in threat hunting and adversary tracking (MITRE ATT&CK for ICS, the Diamond Model, ICS Cyber Kill Chain).
• Proficiency with Synapse and Storm Query Language for data modeling, threat hunting, and investigative workflows.
• Familiarity with network telemetry tools (e.g., NetFlow, Censys, Shodan) and file-based analysis platforms (e.g., VirusTotal, Joe Sandbox).
• Excellent communication skills, including the ability to translate complex findings into WorldView reporting, YIR content, and executive-level briefings.
• Comfort representing technical work externally — webinars, industry events, and customer briefings — and acting as a spokesperson for the team.
• Experience with industrial control systems security and threat intelligence across critical infrastructure sectors.
• Ability to travel up to 10% (both domestic and international). 

Compensation: 

• Salary: $205,000
• Competitive Equity Package  
• Comprehensive Benefits Plan 

#LI-JF1 #LI-REMOTE