SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: EUR 120,000 - 0 / annual
Dragos is hiring an Associate Principal Incident Responder based in Germany to lead operational technology (OT) incident response and strengthen customer incident response maturity across Europe. This is a hybrid role combining hands-on investigation leadership with strategic advisory work.
You will lead end-to-end incident response engagements for industrial customers, serving as Incident Commander during active incidents and delivering decision-grade guidance. Responsibilities include conducting investigations, threat hunts, triage, and compromise assessments in industrial environments; driving investigations to resolution through root-cause analysis, containment, and remediation strategy; participating in on-call rotation; and conducting post-incident reviews to feed lessons learned into playbooks.
Beyond investigations, you will deliver advisory services including IR planning workshops, tabletop exercises, maturity assessments, and purple teaming exercises that align response capabilities with business risk. You will mentor teammates, act as a technical escalation point, and maintain accountability for delivery quality, timeliness, and utilization. You will also build customer relationships and strengthen Dragos services through stakeholder engagement, research, thought leadership, and input on service offerings and delivery models.
Dragos protects critical infrastructure systems—water, power, hospitals—that are under attack daily. The company is the global leader in xOT cybersecurity, combining technology, threat intelligence, and expert services. The team is remote-first and mission-driven, spanning North America, Europe, the Middle East, and APAC.
REQUIREMENTS:
- Must be a German resident
- Fluent in German with working proficiency in English
- 8+ years of hands-on incident response and digital forensics experience, with lead-level scope and depth in at least two of: network, hardware (controllers/instrumentation), memory, or disk forensics. Methodology mastery matters more than tool specialization.
- Proven ability to lead end-to-end investigations, correlating events across data types to uncover threats, hunt malicious activity, and coordinate communications during incidents
- Experience in ICS/OT cybersecurity, including industrial architecture, threat landscapes, vulnerabilities, and frameworks and standards
- Experience in industrial environments (asset owner, operator, integrator, or consultant), with ability to advise at both technical and enterprise-strategy levels
- Consulting or advisory experience, translating technical depth into strategic guidance, with excellent written and verbal communication including customer-facing documentation, playbooks, executive briefings, and calm leadership during high-pressure incidents
- Familiarity with European and German OT regulatory context: NIS2, IT-SiG 2.0, BSI KRITIS, IEC 62443, and NIST CSF
- Willingness to travel up to 40% (domestic and international) to support customer engagements
