Senior Capabilities Developer

Dragos, Inc.; Northern (KY); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Competitive Equity Package

Job summary

Dragos is seeking a Senior Capabilities Developer to build and maintain Synapse collection pipelines, write Storm queries, and shape data models that power OT threat intelligence. You will collaborate with cross-functional teams to scale collection across threat groups and activities.

This remote-first role offers opportunities to contribute to WorldView, Year in Review, and Intelligence Services outputs while improving data quality and automation.

Qualifications

• 3+ years in cyber threat intelligence, detection engineering, or related cybersecurity discipline.
• Proficient with Synapse/Storm for analytical queries and data workflows.
• Experience troubleshooting analytical tooling and scripts.
• Understanding of Synapse hypergraph data model, forms and tag structures.
• Familiarity with telemetry and malware analysis tools for threat hunting.
• Ability to write design docs and collaborate across teams.

Responsibilities

• Build and maintain Synapse collection pipelines through Storm queries, automation, data models, and tag hierarchies.
• Diagnose and resolve complex defects in Synapse tooling and collection systems.
• Support threat hunting and adversary tracking across multiple threat groups.
• Contribute analysis to recurring intelligence outputs with properly modeled data.
• Ensure data quality and close visibility gaps via validation and automation.
• Document designs, improve processes, and share knowledge across the team.
• Collaborate with hunt, research, intelligence, product, and engineering teams.

Skills

Synapse/Storm query language

Threat intelligence

Data modeling

Automation

Cross-functional collaboration

Documentation

Job description

At Dragos, the mission is personal. The systems we protect deliver the water you drink, power your home, and keep the hospitals your community depends on running. Those critical infrastructure systems that power our civilization around the world are under attack every day by adversaries. When those systems fail, people are immediately at risk. We are the global leader in xOT cybersecurity, combining technology, threat intelligence, and expert services. The people here chose this work because they understand what is at stake . Here, you will find a remote-first mission-driven team across North America, Europe, the Middle East, and APAC built on authenticity, transparency, and trust. If safeguarding the systems that protect your family, friends, and community is the kind of work that matters to you, you are in the right place.

About the Role:

Dragos' Capabilities Development team builds the technical foundation behind our OT threat intelligence—not just consuming data, but building the Synapse tooling, collection pipelines, and data models that turn raw threat information into an intelligence fabric for hunters, analysts, and customers. As a Senior Capabilities Developer, you'll build and maintain Synapse collection efforts that feed this fabric, writing Storm queries and automation, shaping tag hierarchies and data models, and scaling collection pipelines across threat groups and temporary activity threats (TATs). You'll partner with the Principal Capabilities Developer and cross-functional teams to resolve complex defects, close data-visibility gaps, and support recurring intelligence outputs, with the opportunity to shape how Dragos operationalizes threat intelligence at scale.

Responsibilities:

• Build and maintain Synapse collection pipelines through Storm queries, automation, data models, and tag hierarchies that support accurate, on-schedule threat data flow.
• Diagnose and resolve complex defects in Synapse tooling and collection systems independently, escalating architectural questions as needed.
• Support threat hunting and adversary tracking using telemetry and malware analysis techniques across multiple threat groups and infrastructure assessments.
• Contribute analysis to recurring intelligence deliverables (WorldView, Year in Review, Intelligence Services products) with validated, properly modeled underlying data.
• Ensure data quality and close visibility gaps through validation, automation identification, and methodological improvement.
• Document designs, improve processes, contribute to team coding standards and testing frameworks, and share knowledge across the team.
• Collaborate across hunt, research, intelligence, product, and engineering functions; support incident response and intel-sharing relationships.

Qualifications:

• 3-5 years of combined experience in cyber threat intelligence, detection engineering, security operations, incident response, or a related cybersecurity discipline.
• Working proficiency with Synapse/Storm query language for analytical queries, data manipulation, and collection workflows.
• Experience troubleshooting and resolving moderately complex to complex defects in analytical tooling or scripts.
• Understanding of Synapse's hypergraph data model, forms, properties, and tag structures.
• Familiarity with telemetry and malware analysis tools in support of threat hunting or adversary tracking.
• Comfortable writing design documentation and collaborating cross-functionally with hunt, intelligence, product, and engineering teams.
• Ability to identify automation opportunities and data-visibility gaps and recommend practical solutions.
• Experience contributing to recurring intelligence outputs (e.g., quarterly or annual reporting) is a plus.

Compensation:

• Competitive Equity Package

#LI-JF1 #LI-REMOTE

Dragos is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under federal, state, or local laws. All new hires must pass a background check as a condition of employment.