John Burns

WORK HISTORY

EDUCATION

ABOUT JOHN BURNS

I work at the intersection of operational technology and cybersecurity, focused on building security programs that hold under pressure.Before moving into cybersecurity, I worked in the field building and programming industrial control systems. That experience shaped how I approach OT security today: with respect for uptime, safety, and the operational realities engineers face every day.I’ve been with Dragos for nearly eight years — joining early and helping build teams and capabilities from the ground up. What began as a single-person function grew into structured teams centered on detection, threat hunting, and disciplined OT security execution.Industrial environments do not tolerate volatility.Security in those environments shouldn’t either.My focus is OT security strategy and ICS threat hunting, helping organizations mature their security posture in high-consequence environments. I care about measurable visibility, monitoring discipline, and response models grounded in operational reality — not security theater.Effective OT security is built on:• Continuous monitoring — not temporary escalation• Hypothesis-driven threat hunting• Detection rigor aligned to real-world tradecraft• Change management discipline• Clear, measured communication during uncertaintyStrategy only works if it survives contact with the field. The most credible security leaders understand how systems actually operate, how teams respond under stress, and where risk meaningfully exists.I share perspectives on:• ICS & OT threat hunting• Detection maturity in industrial networks• Incident response discipline• Security leadership in operational environments• The long game of industrial resilienceThe goal is simple: build security that holds under pressure — because it was built right from the start.