Senior Vulnerability Analyst

About the Role

Dragos is seeking an experienced Senior Vulnerability Analyst to join our Vulnerability Analysis Content Team. The ideal candidate will play a critical role in transforming vulnerability data from public sources into actionable intelligence tailored for operational technology (OT) environments.

Working alongside a team of analysts and engineers, you will be responsible for evaluating, curating, enriching, and contextualizing vulnerability information from CVEs, NVD, vendor advisories, and various other sources to deliver high-quality findings to our customers. This role directly supports Dragos's mission to safeguard industrial infrastructure by producing timely, accurate, and OT-relevant vulnerability intelligence.

Responsibilities

• Evaluate vulnerability disclosures from CVE, NVD, CISA KEV, vendor advisories, and other public sources, and monitor emerging feeds to ensure timely coverage and assess relevance and impact to OT environments.
• Curate and prioritize vulnerabilities based on asset criticality, exploitability, and operational impact to industrial systems.
• Enrich vulnerability data by mapping affected products, firmware versions, and asset classifications to ensure comprehensive coverage.
• Translate technical vulnerability details into actionable, OT-contextualized content for the Dragos platform, including advisories, asset mappings, and mitigation guidance.
• Leverage platform telemetry and maintain product catalogs to identify detection gaps, prioritize coverage, and improve content accuracy.
• Mentor junior analysts by providing technical guidance and quality review of content outputs.
• Collaborate with engineering teams on content creation workflows and validation processes, and contribute to continuous improvement of team processes, content standards, and analysis methodologies.

Qualifications

• 4+ years of experience in vulnerability analysis, vulnerability management, or a related technical security discipline, with a strong understanding of how vulnerabilities originate and work, and the ability to analyze them and provide clear remediation and mitigation guidance.
• Strong understanding of the CVE lifecycle, CVSS scoring, CPE, and vulnerability advisory interpretation, with working knowledge of vulnerability databases, threat intelligence feeds, and security content platforms.
• Demonstrated ability to map vulnerabilities to affected products, firmware versions, and asset inventories.
• Scripting experience in Python or a similar language (basic proficiency) to handle data at scale, such as querying databases and generating signatures, along with familiarity with command-line tooling and git workflows.
• Comfort using AI tools (e.g., Claude) in day-to-day work to improve analysis, content creation, and workflow efficiency.
• Strong written and verbal communication skills, a self-driven approach to work, and the ability to produce clear, accurate, actionable technical content.
• Background in asset management or critical infrastructure sectors (e.g., energy, manufacturing, water, transportation) is a plus.

Compensation

• Salary: $122,000
• Competitive Equity Package
• Comprehensive Benefits Plan

#LI-JF1 #LI-REMOTE