Senior Security Software Engineer: Intrusion Detection & Threat Hunting
Â
About DER Security
DER Security builds the monitoring, intrusion detection, and operational security platform for the modern distributed energy grid. Solar inverters, battery storage, EV chargers, and grid-edge controllers are now first-class network assets. Our Sentry platform passively observes, classifies, and protects DER fleets in production at utility-scale aggregators and behind-the-meter sites. We deploy cyber-physical IDS system that work with any OT systems but deeply inspect DER protocols (IEEE 2030.5, OCPP, Modbus, DNP3, OPC UA, IEC 61850, SunSpec) and ship code around the world that runs in the field and in the cloud.
- We work a 40-hour week with core hours of 8:00 AM–3:00 PM Pacific, Monday through Friday. We have team members in every US time zone.
- Work culture – DERSec has a strong track record of building world-class products within a supportive engineering environment. Our leadership actively encourages personal growth, enables training opportunities, and builds collaborative spaces where every team member can share ideas and help shape the direction of the organization. We’re a team that cares deeply about the mission, and we’re looking for new talent who shares our vision for a secure and interoperable future.
Â
Required Skills & Experience
- 3–7 years of production-grade software engineering experience, with at least two years building intrusion detection logic, SOC tooling, or threat-hunting platforms.
- Strong Python programming experience.
- Direct experience with at least one of: a SIEM (Splunk, Sentinel, Elastic), an IDS (Dragos, Claroty, Nozomi, Suricata, Zeek, Snort), an EDR/XDR platform, or a SOC ticketing/triage stack — as a developer or an operator. Developer experience preferred.
- Working knowledge of attacker tradecraft: MITRE ATT&CK, ICS ATT&CK, lateral movement patterns, common evasion techniques. You can write a detection rule that catches what it’s supposed to catch and explain why it won’t trigger a false-positive.
- Solid grounding in network fundamentals: TCP/IP, TLS, BPFs, packet capture, the layer-2 protocols (ARP, DHCP, LLDP, CDP).
- Comfort operating multiple AI coding agents in parallel — designing the task split, establishing manual review gates at each merge boundary, running automated test/lint as a guardrail, and rejecting agent output that drifts from spec.
Â
Desired Skills & Experience
- Hands-on SOC analyst, threat-hunter, or incident-responder.
- OT/ICS protocol exposure: Modbus, DNP3, OPC UA, IEC 61850, IEC 60870-5-104, IEEE 2030.5.
- Threat-intelligence work: STIX/TAXII or IOC curation.
- Sigma, YARA, or pyshark/Wireshark dissector development.
- Familiarity with the ICS threat landscape (Pipedream/Incontroller, Industroyer family, Volt Typhoon TTPs).
- Knowledge of security frameworks/requirements including NERC CIP, NIS2, IEC 62443, NIST CSF, etc.
- Public conference talks, CTF wins (DEF CON ICS Village, S4), or relevant certifications (GICSP, GCIA, GRID).
Â
Benefits
- Competitive base salary + meaningful equity in a category-defining seed/Series-A stage company.
- Up to $1000/month in medical, dental, vision reimbursement for employee and family.
- Remote-first, with occasional in-person engineering offsites.
- 2+ week PTO with additional 1-week holiday break for entire organization.
- Direct line to founders and to the operators using what you build.
Senior Software Engineer: DER Platforms
Â
About DER Security
DER Security builds the security, monitoring, and test infrastructure for the modern distributed energy grid. We have tools for testing, controlling, and protecting solar inverters, battery storage, EV chargers, and the systems that orchestrate them. Our work spans the full DER stack:
- DERSim: IEEE 1547 / 1547.1-anchored DER simulator. DERSim reproduces the wire-level behavior of advanced-function inverters and storage devices so that aggregators, DERMS platforms, and intrusion-detection rules can be exercised against real protocol traffic.
- CSIP Aggregator: production IEEE 2030.5 / CSIP aggregator. It speaks to upstream utilities and DERMS platforms in the same dialect the certification bodies care about, and downstream to fleets of heterogeneous DER devices. Built from the spec, validated against it, and operated continuously.
- LabTest: advanced inverter test lab and certification harness. LabTest combines DERSim, the CSIP Aggregator, real and emulated devices, encrypted Modbus, and recorded utility scenarios into a single environment where our customers can certify the interoperability and electrical behaviors of equipment.
- The Sentry platform: our passive IDS and asset-discovery system for live OT networks. The world’s first cybersecurity intrusion detection system that understands the physics of the system and can detect and respond to malicious commands and false data injection attacks on the network.
 You will work on these systems and support our customer deployments.
- We work a 40-hour week with core hours of 8:00 AM–3:00 PM Pacific, Monday through Friday. We have team members in every US time zone.
- Work culture – DERSec has a strong track record of building world-class products within a supportive engineering environment. Our leadership actively encourages personal growth, enables training opportunities, and builds collaborative spaces where every team member can share ideas and help shape the direction of the organization. We’re a team that cares deeply about the mission, and we’re looking for new talent who shares our vision for a secure and interoperable future.
Required Skills & Experience
- 3–7 years of production-grade software engineering experience shipping end-to-end features (backend service, cloud infrastructure, and UI).
- Comfort operating multiple AI coding agents in parallel — designing the task split, establishing manual review gates at each merge boundary, running automated test/lint as a guardrail, and rejecting agent output that drifts from spec.
- Extensive experience with Git and formal code reviews.
- Strong Python skills.
- AWS knowledge: IoT Core / MQTT, Lambda, ECS or EKS, IAM, RDS, CloudWatch, Cognito, etc.
- REST API design, versioning, auth, schema evolution, pagination — and the discipline to make the contract match the spec.
- Experience integrating with a structured communications protocol used by EV charging, smart inverter, building automation, telemetry, or similar.
Â
Desired Skills & Experience
- Direct work with IEEE 2030.5 (CSIP), OCPP 1.6/2.0.1/2.1, SunSpec Modbus, or DNP3.
- Modern React (or equivalent) frontend experience. Frontend performance work on operator-facing UIs (Grafana, time-series rendering, large device inventories).
- Additional programming languages: Java, js, C/C++, etc.
- Lower-level programming for embedded systems.
- Queuing, multi-threading architecture, database schema design and implementation.Â
- Open-source contributions to a comms-stack or test-tooling project.
- Familiarity with utility-side aggregator integration patterns.
Â
Benefits
- Competitive base salary + meaningful equity in a category-defining seed/Series-A stage company.
- Up to $1000/month in medical, dental, vision reimbursement for employee and family.
- Remote-first, with occasional in-person engineering offsites.
- 2+ week PTO with additional 1-week holiday break for entire organization.
- Direct line to founders and to the operators using what you build.
