Senior Capabilities Hunter

<div class="content-intro"><p><span class="TextRun SCXW107525881 BCX8" lang="EN-US" data-contrast="none"><span class="NormalTextRun SCXW107525881 BCX8">At Dragos, the mission is personal. The systems we protect deliver the water you drink, power your home, and keep the hospitals your community depends on running. Those critical infrastructure systems that power our civilization around the world are under attack every day by adversaries. When those systems fail, people are </span><span class="NormalTextRun SCXW107525881 BCX8">immediately</span><span class="NormalTextRun SCXW107525881 BCX8"> at risk. </span><span class="NormalTextRun SCXW107525881 BCX8">We are the global leader in </span><span class="NormalTextRun SCXW107525881 BCX8">xOT</span><span class="NormalTextRun SCXW107525881 BCX8"> cybersecurity, combining technology, threat intelligence, and expert services. The people here chose this work because they understand </span><span class="NormalTextRun SCXW107525881 BCX8">what is</span><span class="NormalTextRun SCXW107525881 BCX8"> at stake</span><span class="NormalTextRun SCXW107525881 BCX8">. Here, you will find a remote-first mission-driven team across North America, Europe, the Middle East, and APAC built on authenticity, transparency, and trust. If safeguarding the systems that protect your family, friends, and community is the kind of work that matters to you, you are in the right place.</span></span><span class="EOP Selected SCXW107525881 BCX8" data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":120,"335559739":160,"335559740":360}"> </span></p></div><p><strong><span data-contrast="auto">About the Role</span></strong><span data-contrast="auto">:</span><span data-ccp-props="{}"> </span></p> <p><span data-ccp-props="{}">Dragos' Threat Hunt and Research teams focus intensely on adversary capabilities targeting ICS/OT networks. As a Senior Capabilities Hunter, you'll hunt for, identify, and analyze the tools, techniques, and methodologies that threat actors deploy against critical infrastructure. You'll serve as a technical specialist understanding how adversaries build and deploy their arsenals—from custom malware and exploits to novel attack tradecraft. Working closely with Adversary Hunters and cross-functional teams, you'll develop tools and scripts for capability analysis that inform detection strategies, threat assessments, and customer advisories. Your work directly enhances Dragos' ability to defend against the most advanced threats targeting critical infrastructure globally.</span></p> <p><strong><span data-contrast="auto">Responsibilities</span></strong><span data-contrast="auto">:</span><span data-ccp-props="{}"> </span></p> <ul> <li class="font-claude-response-body whitespace-normal break-words pl-2">Develop and maintain tools and documentation for capability identification and analysis, collaborating across threat hunt, research, intelligence, product, and engineering teams.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Uphold technical excellence through robust code, testing frameworks, and independent problem-solving on complex defects.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Hunt for and analyze adversary capabilities across assigned threat groups, contributing to threat assessments, WorldView reporting, and customer advisories.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Leverage Synapse, Storm Query Language, intel tools (NetFlow, Censys, VirusTotal, Joe Sandbox, Shodan) to support threat tracking and investigative workflows.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Identify automation opportunities in analysis methodologies and recommend solutions for telemetry and data visibility gaps.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Represent the team in external communications, including webinars, industry partnerships, and Year in Review initiatives.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2">Provide hunting and triage support during surge events and incident response engagements.</li> </ul> <p><strong><span data-contrast="auto">Qualifications</span></strong><span data-contrast="auto">:</span><span data-ccp-props="{}"> </span></p> <ul> <li><span data-contrast="auto">2–3 years of experience in Capabilities Development, Threat Hunting, Network-Based Intrusion Analysis, Vulnerability Analysis, and/or Detections Development.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li> <li data-leveltext="" data-font="Symbol" data-listid="15" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1"><span data-contrast="auto">Experience with software development in C#, Python, or similar languages.</span></li> <li data-leveltext="" data-font="Symbol" data-listid="15" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Familiarity with pivoting across the Diamond Model, all stages of the Kill Chain, and MITRE ATT&CK.</li> <li data-leveltext="" data-font="Symbol" data-listid="15" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Strong report writing skills, with experience producing technical intelligence reports for operational teams and customer-facing audiences.</li> <li data-leveltext="" data-font="Symbol" data-listid="15" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Demonstrated knowledge of adversarial Threat Groups, including tactics, techniques, procedures, and the adversary lifecycle.</li> <li data-leveltext="" data-font="Symbol" data-listid="15" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Experience contributing to cross-functional projects and collaborating with internal and external teams.</li> <li data-leveltext="" data-font="Symbol" data-listid="15" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Knowledge of network analysis and common malware functionality and operations<span data-contrast="auto">.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li> </ul> <p><strong><span data-contrast="auto">Compensation</span></strong><span data-contrast="auto">:</span><span data-ccp-props="{}"> </span></p> <ul> <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559683":0,"335559684":-2,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1"><span data-contrast="none">Salary: $152,000</span></li> <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559683":0,"335559684":-2,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1">Competitive Equity Package <span data-ccp-props="{"134233117":false,"134233118":false,"335551550":0,"335551620":0,"335557856":16777215,"335559738":0,"335559739":0}"> </span></li> <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{"335552541":1,"335559683":0,"335559684":-2,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1">Comprehensive Benefits Plan<span data-ccp-props="{"134233117":false,"134233118":false,"335551550":0,"335551620":0,"335557856":16777215,"335559738":0,"335559739":0}"> </span></li> </ul> <p><span data-ccp-props="{}"> </span></p> <p><span data-contrast="none">#LI-JF1 #LI-REMOTE </span> <span data-ccp-props="{}"> </span></p> <p><span data-ccp-props="{}"><span data-ccp-props="{"134233117":false,"134233118":false,"335551550":0,"335551620":0,"335557856":16777215,"335559738":240,"335559739":240}"> </span></span></p> <p> </p><div class="content-conclusion"><p>Dragos is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under federal, state, or local laws. All new hires must pass a background check as a condition of employment.</p></div>