At Dragos, the mission is personal. The systems we protect deliver the water you drink, power your home, and keep the hospitals your community depends on running. Those critical infrastructure systems that power our civilization around the world are under attack every day by adversaries. When those systems fail, people are immediately at risk. We are the global leader in xOT cybersecurity, combining technology, threat intelligence, and expert services. The people here chose this work because they understand what is at stake. Here, you will find a remote-first mission-driven team across North America, Europe, the Middle East, and APAC built on authenticity, transparency, and trust. If safeguarding the systems that protect your family, friends, and community is the kind of work that matters to you, you are in the right place.
About the Role:
Dragos' Capabilities Development team builds the technical foundation behind our OT threat intelligence—not just consuming data, but building the Synapse tooling, collection pipelines, and data models that turn raw threat information into an intelligence fabric for hunters, analysts, and customers. As a Senior Capabilities Developer, you'll build and maintain Synapse collection efforts that feed this fabric, writing Storm queries and automation, shaping tag hierarchies and data models, and scaling collection pipelines across threat groups and temporary activity threats (TATs). You'll partner with the Principal Capabilities Developer and cross-functional teams to resolve complex defects, close data-visibility gaps, and support recurring intelligence outputs, with the opportunity to shape how Dragos operationalizes threat intelligence at scale.
Responsibilities:
- Build and maintain Synapse collection pipelines through Storm queries, automation, data models, and tag hierarchies that support accurate, on-schedule threat data flow.
- Diagnose and resolve complex defects in Synapse tooling and collection systems independently, escalating architectural questions as needed.
- Support threat hunting and adversary tracking using telemetry and malware analysis techniques across multiple threat groups and infrastructure assessments.
- Contribute analysis to recurring intelligence deliverables (WorldView, Year in Review, Intelligence Services products) with validated, properly modeled underlying data.
- Ensure data quality and close visibility gaps through validation, automation identification, and methodological improvement.
- Document designs, improve processes, contribute to team coding standards and testing frameworks, and share knowledge across the team.
- Collaborate across hunt, research, intelligence, product, and engineering functions; support incident response and intel-sharing relationships.
Qualifications:
- 3-5 years of combined experience in cyber threat intelligence, detection engineering, security operations, incident response, or a related cybersecurity discipline.
- Working proficiency with Synapse/Storm query language for analytical queries, data manipulation, and collection workflows.
- Experience troubleshooting and resolving moderately complex to complex defects in analytical tooling or scripts.
- Understanding of Synapse's hypergraph data model, forms, properties, and tag structures.
- Familiarity with telemetry and malware analysis tools in support of threat hunting or adversary tracking.
- Comfortable writing design documentation and collaborating cross-functionally with hunt, intelligence, product, and engineering teams.
- Ability to identify automation opportunities and data-visibility gaps and recommend practical solutions.
- Experience contributing to recurring intelligence outputs (e.g., quarterly or annual reporting) is a plus.
Compensation:
- Salary: $152,000
- Competitive Equity Package
- Comprehensive Benefits Plan
#LI-JF1 #LI-REMOTE
Dragos is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under federal, state, or local laws. All new hires must pass a background check as a condition of employment.
Skills Required
- 3-5 years combined experience in cyber threat intelligence, detection engineering, security operations, incident response, or related cybersecurity discipline
- Working proficiency with Synapse/Storm query language for analytical queries, data manipulation, and collection workflows
- Experience troubleshooting and resolving moderately complex to complex defects in analytical tooling or scripts
- Understanding of Synapse's hypergraph data model, forms, properties, and tag structures
- Familiarity with telemetry and malware analysis tools in support of threat hunting or adversary tracking
- Comfortable writing design documentation and collaborating cross-functionally with hunt, intelligence, product, and engineering teams
- Ability to identify automation opportunities and data-visibility gaps and recommend practical solutions
- Experience contributing to recurring intelligence outputs (e.g., quarterly or annual reporting)
- Must pass a background check as a condition of employment
What We Do
Dragos is an industrial (OT/ICS/IIoT) cybersecurity company on a mission to safeguard civilization. Our integrated software platform provides critical visibility into ICS and OT networks so that threats are identified, and can be addressed before they become significant events, our solutions are optimized for emerging applications like the Industrial Internet of Things (IIoT), enabling our clients in power and water utilities, energy, and manufacturing industries to establish a resilient and adaptable security posture.
Dragos Offices
Remote Workspace
Employees work remotely.
