Staff Security Researcher, Vulnerability Research – Emergent Threat Response, Metasploit

This is a fully remote position, open to applicants in United States.

📋 Description

• Assess newly identified and actively exploited vulnerabilities within tight deadlines.

• Analyze the root cause of vulnerabilities, their exploitability, and their real-world consequences.

• Reproduce vulnerabilities and create functional exploits using patch diffs, advisories, and limited public data.

• Document differences in behavior across affected versions and platforms.

• Publish technically rigorous analyses of root causes.

• Provide guidance to detection and vulnerability check engineers regarding coverage.

• Assist internal teams and clients in understanding the urgency and impact of threats.

• Act as a primary expert during fast-paced security incidents.

• Develop and contribute high-quality exploit modules to Metasploit.

• Enhance the Metasploit Framework by adding new features, tools, library improvements, and quality enhancements.

• Evaluate community and internal module contributions.

• Collaborate with the Metasploit engineering team on roadmap priorities.

• Identify and investigate new vulnerabilities impacting enterprise technologies.

• Help establish long-term research priorities and perspectives on emerging attack surfaces.

• Contribute technical trend analysis for Rapid7 research reports and publications.

• Represent the team's work through conference presentations, webcasts, blog posts, and media interactions.

• Mentor and develop fellow researchers through code reviews, collaborative work, documentation, and technical advice.

• Clearly convey technical risks to audiences ranging from engineers to executives.

⛳️ Requirements

• Proven expertise across most major vulnerability categories and exploitation techniques.

• Ability to swiftly and effectively reproduce vulnerabilities and attacks.

• Experience in developing intricate exploit chains from the ground up, including from patch diffs or minimal public information.

• Strong reverse engineering and binary/code diffing capabilities, particularly with large codebases or binaries.

• Expert-level knowledge of networking and operating system internals for one or more major operating systems, and/or bypassing common exploit mitigations.

• Demonstrated history of writing about vulnerabilities and exploits for a public audience.

• Proven experience speaking about research at conferences, webcasts, or similar venues.

• Ability to create custom tools as required.

• Skill in breaking down work into clear milestones rather than large monolithic deliverables.

• Willingness to mentor and educate others.

• Clear communication of objectives, rationale, complex attack patterns, and risks to technical stakeholders and detection engineers.

• Experience in driving change and focusing on emerging threats.

• Accountability for achieving outcomes and fulfilling commitments.

• Experience collaborating cross-functionally during time-sensitive security incidents.

• Ability to translate technical findings for non-technical audiences.

• Alignment with Rapid7's core values.

• Published zero-day vulnerabilities and CVEs (preferred).

• Prior contributions to the Metasploit Framework or other open-source security projects (preferred).

• Media training or experience interacting with journalists (preferred).

• Experience utilizing AI or LLM-based tools to enhance vulnerability research or exploit development (preferred).

🏝️ Benefits

• Variable/incentive compensation (not included in base salary range).

• Equity (where applicable/eligible).

• Benefits (where applicable/eligible).

• Fair and equitable compensation practices.