Senior Cyber Threat Intelligence Analyst (Remote)

About the role

Dragos Global Threat Intelligence protects critical infrastructure such as water, power, food processing and oil and gas. It is seeking a Senior Cyber Threat Intelligence Analyst to embed with an Australian customer team as an autonomous expert. The analyst leads threat hunts, delivers tailored intelligence in several formats and represents Dragos inside customer environments, making independent judgments that shape government strategy while collaborating with Dragos delivery teams.

Key responsibilities

• Support the client with ICS/OT cyber threat intelligence needs, including high-stakes situations involving national security priorities, and establish credibility to drive priorities.
• Drive ICS/OT threat research, analysis and hunting using proprietary and commercial resources, performing freeform and hypothesis-driven hunts by analysing network traffic and industrial protocols.
• Help the client establish baseline OT asset and network behaviours using Dragos Platform, Synapse and complementary tools to validate and prioritise leads.
• Contextualise ICS/OT threats and risks, give guidance on best practices and mitigations, and build deep expertise in threats specific to the client's OT environment.
• Translate hunt results into MITRE ATT&CK for ICS mappings and confidence-based assessments usable by non-technical stakeholders.
• Support the client during incident response engagements and exercises.
• Develop industry-focused technical and strategic ICS/OT CTI content and give feedback to internal Dragos teams.

Required profile

• Minimum 4 years of cyber threat intelligence experience using multiple data sources such as NetFlow, open-source intelligence, SIEMs and malware repositories.
• Proven track record delivering tailored threat intelligence to service organisations.
• Customer-facing experience with the ability to manage stakeholders independently.
• Strong technical and strategic writing skills, including threat modelling frameworks such as the Diamond Model of Intrusion Analysis.

Required skills

• Hands-on threat hunting, including packet capture analysis and industrial protocol inspection.
• Proficiency with data aggregation, hunting and analysis tools such as Synapse, and experience using AI/LLM resources in CTI workflows.
• Preferred: deep knowledge of ICS/OT threats, adversary TTPs and technologies (PLCs, HMIs, RTUs), and the ability to deliver CTI analysis using MITRE ATT&CK for ICS, D3FEND and the ICS Cyber Kill Chain.

What we offer

• Salary of AUD 150,000.
• Competitive equity package.
• Comprehensive benefits plan.