Senior Capabilities Developer for OT Threat Intel

Dragos, Inc.; Lennox Park (MD); On-site; USD 137,000 - 167,000; Full time

Benefits offered by this job

Equity package

Benefits plan

Job summary

Dragos, Inc. is a remote‑first leader in OT cybersecurity, protecting critical infrastructure worldwide.

As a Senior Capabilities Developer, you will build and maintain Synapse collection pipelines, write Storm queries, shape data models, and scale collection across threat groups, collaborating with cross‑functional teams to operationalize threat intelligence at scale. You will work with the Principal Capabilities Developer and teams to resolve defects, support threat hunting, and contribute to

Qualifications

• 3-5 years of combined experience in cyber threat intelligence, detection engineering, security operations, incident response, or related cybersecurity discipline.
• Working proficiency with Synapse/Storm query language for analytical queries, data manipulation, and collection workflows.
• Experience troubleshooting and resolving moderately complex to complex defects in analytical tooling or scripts.
• Understanding of Synapse's hypergraph data model, forms, properties, and tag structures.
• Familiarity with telemetry and malware analysis tools in support of threat hunting or adversary tracking.
• Comfortable writing design documentation and collaborating cross-functionally with hunt, intelligence, product, and engineering teams.
• Ability to identify automation opportunities and data-visibility gaps and recommend practical solutions.
• Experience contributing to recurring intelligence outputs (e.g., quarterly or annual reporting) is a plus.

Responsibilities

• Build and maintain Synapse collection pipelines through Storm queries, automation, data models, and tag hierarchies that support accurate, on‑schedule threat data flow.
• Diagnose and resolve complex defects in Synapse tooling and collection systems independently, escalating architectural questions as needed.
• Support threat hunting and adversary tracking using telemetry and malware analysis techniques across multiple threat groups and infrastructure assessments.
• Contribute analysis to recurring intelligence deliverables (WorldView, Year in Review, Intelligence Services products) with validated, properly modeled underlying data.
• Ensure data quality and close visibility gaps through validation, automation identification, and methodological improvement.
• Document designs, improve processes, contribute to team coding standards and testing frameworks, and share knowledge across the team.
• Collaborate across hunt, research, intelligence, product, and engineering functions; support incident response and intel‑sharing relationships.

Skills

Synapse/Storm queries

Threat intelligence

Data modeling

Troubleshooting tooling

Cross-functional collaboration

Automation opportunities

Documentation

Incident response support

Job description

Dragos, Inc. is a remote‑first leader in OT cybersecurity, protecting critical infrastructure worldwide.

As a Senior Capabilities Developer, you will build and maintain Synapse collection pipelines, write Storm queries, shape data models, and scale collection across threat groups, collaborating with cross‑functional teams to operationalize threat intelligence at scale. You will work with the Principal Capabilities Developer and teams to resolve defects, support threat hunting, and contribute to