Staff Reverse Engineer

Dragos is on a relentless mission to defend industrial organizations that provide us with the necessities of modern civilization: running water, functioning electricity, and safe industrial working environments. As the market leader in ICS/OT Cybersecurity, we are dedicated to arming our customers with best-in-class technology, threat intelligence, and services to protect their systems as effectively and efficiently as possible. We're a remote-first culture with operations in North America, Europe, the Middle East, and APAC. We're looking for mission-oriented teammates who embody our core values of authenticity, transparency and trust. Are you ready to make a difference? Come join a mission that can save the world!

About the role:

Our Engineering org is seeking a Staff Reverse Engineer to join its Content team. In this role you will partner closely with diverse teams to drive insights in industrial protocol analysis, network situational awareness and threat behavioral analytics.

Location: USA (Remote)

• Analyze, reverse-engineer, and document industrial network protocols and functions related to system modification, command and control, encryption/encoding, etc.
• Generate innovative asset identification capabilities, protocol parsers, and threat behavior analytics for the Dragos Platform.
• Conduct in-depth reverse engineering of hardware and software to support designing and building detection logic.
• Contribute to and integrate with teams CI/CD and testing standards, authoring unit, integration, and end two end tests to verify characterizations and detections are working as expected.
• Participate in efforts for discovering and cataloging OT assets using advanced detection methodologies.
• Partner with developers to integrate findings into Dragos's threat detection and response platform.
• Contribute to the creation of detection logic and rules for real-time threat monitoring of atomic operations.
• Troubleshoot and fix both internal engine configurations and python analytics use for asset identification and atomic operations. Collect PCAPs using OSINT, Generate PCAPs utilizing test range, or craft PCAPs utilizing software to use in both detection development and regression testing.
• Effectively assign tasks to teammates; receive guidance and direction openly; give recommendations and collaborate across the team.
• Provide technical and professional mentorship to teammates.

• 5+ years utilizing static and dynamic analysis tools to conduct in-depth reverse engineering of hardware or software without source.
• 3+ years in cyber security related field; operations, threat hunting, detection development, offensive operations, threat emulation, security research, or security tool development.
• 2+ years of development experience with python in a production DevOps environment.
• Prior development/scripting experience (e.g., C++, Rust, Ruby, Go, Lua, etc.)
• Proficiency in x86/x86_64 intel assembly and disassemblers, including IDA Pro, Binary Ninja and Ghidra.
• Awareness of standard operating system internals and the ability to identify analytic opportunities
• Applied knowledge of communication fundamentals to include network and serial traffic
• Experience using Suricata, Wireshark/tshark for network packet capture (PCAPs) analysis, and SIEM tools.
• Familiarity with containerized solutions for debugging.
• A solid understanding of both Linux and windows command line tools for debugging.
• Strong ability to conduct open-source research.
• Ability to generate best practices/procedures and effectively implement and teach others.
• Ability to generate high-quality technical documents though means of knowledge sharing within Engineering and outside departments.

• Salary: $192,000
• Competitive Equity Package
• Comprehensive Benefits Plan

Dragos is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under federal, state, or local laws. All new hires must pass a background check as a condition of employment.

#LI-JF1 #LI-REMOTE