Staff Security Researcher, Vulnerability Research – Emergent Threat Response, Metasploit

Job not on LinkedIn

🔥 26 minutes ago

🇺🇸 United States – Remote

💵 $156.4k - $211.6k / year

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Rapid7

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2000

🔒 Cybersecurity

Cybersecurity

Rapid7 is a cybersecurity company that provides a range of solutions designed to secure cloud, identity, and endpoint products. The company's Command Platform utilizes artificial intelligence to offer deep insights into cybersecurity threats and vulnerabilities. Rapid7's offerings include Managed XDR for continuous monitoring, detection, and incident response, as well as tools for attack surface management, vulnerability management, and threat intelligence. The company is known for its open-source projects like Metasploit and Velociraptor, which aid in vulnerability research and enhancing cybersecurity frameworks. Rapid7 also emphasizes community and culture, contributing to diversity, equity, and inclusion, and engages in public policy advocacy to strengthen cybersecurity on a broader scale. They serve over 11,000 global companies and deliver expert analysis on attack trends and emergent threats through Rapid7 Labs.

📋 Description

• Analyze newly disclosed and actively exploited vulnerabilities under tight timelines • Determine vulnerability root cause, exploitability, and real-world impact • Reproduce vulnerabilities and build working exploits from patch diffs, advisories, and limited public information • Document behavioral differences across affected versions and platforms • Publish technically rigorous root cause analyses • Advise detection and vulnerability check engineers on coverage • Help internal teams and customers understand threat urgency and impact • Serve as a go-to expert during high-velocity security events • Develop and contribute high-quality exploit modules to Metasploit • Improve the Metasploit Framework through new capabilities, tooling, library enhancements, and quality improvements • Review community and internal module contributions • Partner with the Metasploit engineering team on roadmap priorities • Identify and research new vulnerabilities affecting enterprise technologies • Help define longer-term research priorities and emerging attack-surface perspectives • Contribute technical trend analysis to Rapid7 research reports and publications • Represent the team's work through conference talks, webcasts, blog posts, and media engagements • Mentor and develop other researchers through code review, pairing, documentation, and technical guidance • Explain technical risk to audiences ranging from engineers to executives

🎯 Requirements

• Demonstrable expertise across most major vulnerability classes and exploitation techniques • Ability to reproduce vulnerabilities and attacks quickly and effectively • Experience developing complex exploit chains from scratch, including from patch diffs or minimal public detail • Strong reverse engineering and binary/code diffing skills, including against large codebases or binaries • Expert-level understanding of networking, operating system internals for one or more major operating systems, and/or bypassing common exploit mitigations • Track record of writing about vulnerabilities and exploits for a public audience • Track record of speaking about research at conferences, webcasts, or similar venues • Ability to build custom tooling as needed • Ability to scope work into clear milestones rather than monolithic deliverables • Willingness to mentor and teach • Clear communication of objectives, rationale, complex attack patterns, and risks to technical stakeholders and detection engineers • Experience driving change and focusing on emerging threats • Accountability for driving outcomes and meeting commitments • Experience working cross-functionally during time-sensitive security events • Ability to translate technical findings for non-technical stakeholders • Alignment with Rapid7's core values • Published zero-day vulnerabilities and CVEs (nice to have) • Prior contributions to the Metasploit Framework or other open source security projects (nice to have) • Media training or experience speaking with journalists (nice to have) • Experience applying AI or LLM-based tooling to accelerate vulnerability research or exploit development (nice to have)

🏖️ Benefits

• Variable/incentive compensation (excluded from base salary range) • Equity (where applicable/eligible) • Benefits (where applicable/eligible) • Fair and equitable compensation practices

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume