At Dragos, the mission is personal. The systems we protect deliver the water you drink, power your home, and keep the hospitals your community depends on running. Those critical infrastructure systems that power our civilization around the world are under attack every day by adversaries. When those systems fail, people are immediately at risk. We are the global leader in xOT cybersecurity, combining technology, threat intelligence, and expert services. The people here chose this work because they understand what is at stake. Here, you will find a remote-first mission-driven team across North America, Europe, the Middle East, and APAC built on authenticity, transparency, and trust. If safeguarding the systems that protect your family, friends, and community is the kind of work that matters to you, you are in the right place.
About the Role:
Our Professional Services Team is seeking Associate Principal OT Penetration Tester who will provide technical leadership across vulnerability assessments, penetration testing, and adversary emulation activities supporting customer services engagements. You will shape engagement strategy and uncover real‑world attack paths across ICS/OT networks through hands‑on exploitation and deep technical analysis, working closely with customers across critical infrastructure sectors such as oil and gas, electric, water treatment, and manufacturing. You will also translate findings into clear, actionable remediation guidance, influencing detection and platform development. You will mentor team members and be an advisor and representative of Dragos within the broader OT security community.
Responsibilities:
- Serve as primary technical lead and trusted advisor for Dragos’s most complex, high-impact industrial penetration testing, purple teaming, and vulnerability assessment engagements, shaping engagement direction and aligning deep technical execution with client business goals.
- Set the technical bar for OT penetration testing excellence by defining methodologies, assessment frameworks, and red team tactics informed by threat intelligence and adversary emulation. Design and lead offensive campaigns modeled on known and unknown TTPs to uncover complex attack paths across IT/OT boundaries and within industrial environments.
- Translate hands-on findings into strategic R&D priorities, guiding the development of proprietary tools, behavioral analytics, and detection content by identifying gaps in visibility, response, and prevention in customer environments.
- Evolve internal playbooks, runbooks, and operating procedures, applying field lessons, threat intelligence, and emerging adversary behaviors to improve the efficiency, scalability, and effectiveness of the penetration testing practice.
- Engage executive stakeholders, internally and externally, with strategic cybersecurity guidance, risk prioritization, and remediation recommendations tied to business objectives, delivering clear, authoritative presentations to C-suites, boards, and technical leadership.
- Represent Dragos as an industry thought leader through original research, top-tier conference presentations, whitepapers, and public engagements that advance OT security with unique insights and innovation.
- Mentor engineering, threat intelligence, and consulting teams across functions, cultivating future leaders and a culture of continuous learning, technical curiosity, and mission-driven execution.
Qualifications:
- 8+ years of hands-on cybersecurity experience in vulnerability assessment, penetration testing, or red teaming within the OT space, with in-depth knowledge of OT penetration testing methodologies in white, gray, and black-box contexts.
- Deep understanding of OT-specific architectures and services, including DCS, historians, SCADA networks, transmission/distribution management, AMI, related communication protocols, and other control systems.
- Extensive knowledge of OT cyber threats, attack paths, exploits, and adversary TTPs.
- Hands-on experience with offensive security tooling such as Metasploit, Nmap, Kali Linux, Cobalt Strike, Burp Suite, common LOTL toolsets, and C2 frameworks.
- Advanced experience with networking components (routers, switches, load balancers, firewalls), plus the ability to analyze network traffic and host data in a cybersecurity context.
- Proven experience using large language models (e.g., Claude) to support penetration testing execution and reporting, including reconnaissance, exploit development, and drafting findings, with sound judgment in validating AI-generated output and securely handling client data.
- Strong report-writing and presentation skills, with the ability to communicate findings clearly to both technical and non-technical audiences.
- Ability to work independently in a remote environment and coordinate across distributed teams, with willingness to travel up to 30-40% (domestic and international) to support customer engagements.
Compensation:
- Salary: £105,000
- Competitive Equity Package
- Comprehensive Benefits Plan
#LI-JF1 #LI-REMOTE
Dragos is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under federal, state, or local laws. All new hires must pass a background check as a condition of employment.
Skills Required
- 8+ years of hands-on cybersecurity experience in OT vulnerability assessment, penetration testing, or red teaming
- In-depth knowledge of OT penetration testing methodologies across white-box, gray-box, and black-box contexts
- Deep understanding of OT architectures and services, including DCS, historians, SCADA networks, transmission/distribution management, AMI, communication protocols, and control systems
- Extensive knowledge of OT cyber threats, attack paths, exploits, and adversary tactics, techniques, and procedures
- Hands-on experience with Metasploit, Nmap, Kali Linux, Cobalt Strike, Burp Suite, LOLT toolsets, and C2 frameworks
- Advanced experience with routers, switches, load balancers, firewalls, network traffic analysis, and host-data analysis
- Experience using large language models such as Claude for penetration testing execution and reporting
- Ability to validate AI-generated output and securely handle client data
- Strong report-writing and presentation skills for technical and non-technical audiences
- Ability to work independently in a remote environment and coordinate across distributed teams
- Willingness to travel 30–40% domestically and internationally
Dragos Compensation & Benefits Highlights
-
Fair & Transparent Compensation — Compensation is presented with upfront disclosure in job postings, including salary, the assigned value of benefits, and equity. Materials also describe level-based ranges and a pay philosophy benchmarked toward the top end of the market across locations.
-
Leave & Time Off Breadth — Paid time off is portrayed as generous, with reports of an unlimited PTO policy alongside paid holidays and other leave types. Feedback suggests flexibility helps employees use time off in practice.
-
Wellbeing & Lifestyle Benefits — Benefits lineups commonly include medical, dental, and vision coverage plus HSAs/FSAs, mental-health support, and an EAP. This breadth indicates a rounded approach to wellness beyond core insurance.
Dragos Insights
What We Do
At Dragos, every role advances a mission that matters. Surrounded by people with deep expertise, you’re trusted to own your work, grow your impact and your craft, while safeguarding civilization. Dragos delivers xOT cybersecurity for industrial and critical infrastructure, backed by a decade of frontline incident response experience. The Dragos Platform provides asset visibility, continuous monitoring, vulnerability management, and real-time threat detection, all powered by industry-leading intelligence. Dragos protects OT environments globally, including electric, oil & gas, manufacturing, water, and transportation.
Gallery
Dragos Offices
Remote Workspace
Employees work remotely.
