Associate Principal Incident Responder

The role

You will lead OT incident response and strengthen customer IR maturity across Europe. You will run active investigations and deliver advisory work including maturity assessments, tabletop exercises, and purple teaming.

What you will do

• Lead incident response engagements for industrial customers onsite and remotely.
• Serve as Incident Commander during active incidents.
• Drive investigations to resolution from root-cause analysis to containment and remediation.
• Participate in the on-call rotation.
• Conduct after-action reviews and feed lessons learned into playbooks and procedures.
• Deliver advisory services such as IR planning workshops, tabletop exercises, and maturity assessments.
• Mentor teammates and act as a technical escalation point.
• Build customer relationships through stakeholder engagement, research, and thought leadership.
• Provide input on service offerings and delivery models.

Required qualifications

• Must be a German resident.
• Fluent in German with a working proficiency in English.
• 8+ years of hands-on incident response and digital forensics experience.
• Lead-level scope and depth in at least two of network, hardware (controllers/instrumentation), memory, or disk forensics.
• Proven ability to lead end-to-end investigations.
• Experience in ICS/OT cybersecurity, including industrial architecture, threat landscapes, vulnerabilities, and frameworks and standards.
• Experience in industrial environments (asset owner, operator, integrator, or consultant).
• Consulting or advisory experience.
• Excellent written and verbal communication.
• Familiarity with the European and German OT regulatory context: NIS2, IT-SiG 2.0, BSI KRITIS, IEC 62443, and NIST CSF.
• Willingness to travel up to 40% (domestic and international).

Benefits

• Competitive Equity Package
• Comprehensive Benefits Plan

Before you apply

• All new hires must pass a background check as a condition of employment.

About the company

Dragos is the global leader in xOT cybersecurity, combining technology, threat intelligence, and expert services. The team is remote-first across North America, Europe, the Middle East, and APAC.