Principal Vulnerability Analyst

Dragos · United States

// classified as

Other (Adjacent or hard to classify.)

> stack

cpython

> description

<div class="content-intro">At Dragos, the mission is personal. The systems we protect deliver the water you drink, power your home, and keep the hospitals your community depends on running. Those critical infrastructure systems that power our civilization around the world are under attack every day by adversaries. When those systems fail, people are immediately at risk. We are the global leader in xOT cybersecurity, combining technology, threat intelligence, and expert services. The people here chose this work because they understand what is at stake. Here, you will find a remote-first mission-driven team across North America, Europe, the Middle East, and APAC built on authenticity, transparency, and trust. If safeguarding the systems that protect your family, friends, and community is the kind of work that matters to you, you are in the right place.<span class="EOP Selected SCXW107525881 BCX8" data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":120,"335559739":160,"335559740":360}"> </div>About the Role:  Dragos' Vulnerability Analysis team identifies novel security gaps in the industrial control systems that power plants, water utilities, and manufacturing facilities depend on—and translates those findings into detections and actionable intelligence that defend critical infrastructure. As a Principal Vulnerability Analyst, you'll operate with high autonomy to identify research targets, perform in-depth vulnerability analysis, coordinate with affected vendors, and author vulnerability reports that shape how the industry understands emerging threats. You'll partner across threat intelligence, product engineering, and incident response teams to amplify the real-world impact of your work. Working alongside another vulnerability analyst, you'll serve as a recognized subject matter expert and trusted internal resource—mentoring researchers and penetration testers, driving methodology development, and helping identify gaps in the Dragos Platform's ability to detect new exploits. Responsibilities:  <ul> <li class="font-claude-response-body whitespace-normal break-words pl-2">Identify novel vulnerabilities in industrial products and control systems through strategic acquisition and rigorous analysis, assessing operational impact on both IT and ICS environments.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Coordinate responsible disclosure with affected vendors and author clear, technically rigorous vulnerability reports for internal customers and public publication.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Develop detection signatures (Suricata, YARA, internal analytics) and partner with product engineering to identify and close gaps in the Dragos Platform's vulnerability detection capabilities.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Serve as a trusted internal resource to threat intelligence and incident response teams, assessing in-the-wild exploits, analyzing vulnerability trends, and integrating findings into broader threat intelligence.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Contribute to the strategic vulnerability management roadmap and collaborate with customers and strategic partners on vulnerability research projects that advance collective defense.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Mentor other researchers and penetration testers while communicating Dragos expertise through public reporting, industry presentations, and engagement with the security community.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Champion the adoption of automated vulnerability analysis tools and processes to scale research capabilities and optimize team workflows.</li> </ul> Qualifications:  <ul> <li class="font-claude-response-body whitespace-normal break-words pl-2">5+ years developing, deploying, or evaluating proof-of-concept code related to vulnerabilities.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Demonstrable expertise in embedded systems reverse engineering or binary reverse engineering of Windows and/or embedded applications.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Strong familiarity with binary network protocols and low-level networking concepts.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">3+ years writing customer-facing technical material and demonstrated ability to translate complex details to inform decision-makers and operators.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">In-depth understanding of vulnerability scoring mechanisms, their benefits and limitations in OT context, and measured ability to assess real-world operational impact.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Proven ability to function independently to identify devices and software to assess, determine acquisition strategies, and develop analysis roadmaps.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Demonstrated proficiency developing software tooling or analytical automation using Python, C#, or similar languages to enhance team workflows and scale research.</li> </ul> Nice to Haves: <ul> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Experience reverse engineering malware using static and dynamic analysis tools and techniques, with familiarity of malware code constructs.</li> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Experience developing YARA, Snort, Suricata or Zeek detections rules.</li> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Experience working with an operations center and incident response team during live engagements.</li> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Track record of discovering and responsibly disclosing novel vulnerabilities.</li> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Familiarity with ICS protocols (Modbus, DNP3, Profibus, etc.) and their security properties.</li> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">External presence or track record of knowledge sharing through publications, conference presentations, or industry engagement. </li> </ul> Compensation:  <ul> <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559683":0,"335559684":-2,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1">Salary: $170,000</li> <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559683":0,"335559684":-2,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1">Competitive Equity Package  </li> <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559683":0,"335559684":-2,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1">Comprehensive Benefits Plan </li> </ul>   #LI-JF1 #LI-REMOTE       <div class="content-conclusion">Dragos is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under federal, state, or local laws. All new hires must pass a background check as a condition of employment.</div>