Staff Security Researcher, Vulnerability Research (Emergent Threat Response & Metasploit)

Rapid7's vulnerability intelligence team does industry-leading offensive research that helps organizations worldwide understand and prioritize real risk. When a critical vulnerability starts getting exploited in the wild, we're the team that figures out what's actually happening, how bad it is, and what defenders need to do about it. We're looking for an experienced vulnerability researcher to help lead that work, with a strong focus on rapid n-day analysis and on making Metasploit better for the security community.

About the Team

Rapid7 vulnerability researchers analyze high-priority n-day vulnerabilities, write Metasploit modules, find and publish zero-day vulnerabilities, and help customers, the media, internal teams, and the public understand which threats matter and why. We drive Rapid7's company-wide Emergent Threat Response (ETR) program, coordinating our research, product coverage, and customer guidance when widespread attacks hit. We aren't satisfied with being purely reactive, though. We also look for the vulnerabilities and attack patterns that will become tomorrow's widespread threats.

About the Role

This role sits at the Staff level, a senior technical leadership position on our individual contributor track. Your time will be focused primarily on Emergent Threat Response and Metasploit, with zero-day research as a secondary focus.

Primary focus: Emergent Threat Response (n-day research)

• Rapidly analyze newly disclosed and actively exploited vulnerabilities, often under tight timelines, to determine root cause, exploitability, and real-world impact
• Reproduce vulnerabilities and build working exploits from patch diffs, advisories, and limited public information, documenting behavioral differences across affected versions and platforms
• Publish clear, technically rigorous root cause analyses that help defenders act quickly and reflect Rapid7's attacker-focused approach to vulnerability intelligence
• Advise detection and vulnerability check engineers as they build coverage, and help internal teams and customers understand what's urgent, what isn't, and why
• Serve as a go-to expert during high-velocity events (think Log4Shell), knowing when to raise alarms and when to counsel patience

Primary focus: Metasploit

• Develop and contribute high-quality exploit modules to Metasploit, especially for high-priority vulnerabilities coming out of ETR work
• Drive improvements to the Metasploit Framework itself, including new capabilities, tooling, library enhancements, and quality improvements that make the framework more effective for researchers and practitioners
• Review community and internal module contributions, raising the bar for code qua
• lity, reliability, and stability across the project
• Partner with the Metasploit engineering team on roadmap priorities and help shape where the framework goes next

Secondary focus: Zero-day research

• Identify and research, new vulnerabilities in technologies that matter to enterprise organizations
• Help define longer-term research priorities with the broader team, bringing a point of view on emerging attack surface

Across all of it

• Contribute technical trend analysis to Rapid7's research reports and publications
• Represent the team's work through conference talks, webcasts, blog posts, and media engagements
• Mentor and develop other researchers through code review, pairing, documentation, and technical guidance
• Explain technical risk clearly to audiences ranging from engineers to executives

The skills and qualities you'll bring include

• Demonstrable expertise across most major vulnerability classes and exploitation techniques, with the ability to reproduce vulnerabilities and attacks quickly and effectively
• Experience developing complex exploit chains from scratch, including from patch diffs or minimal public detail
• Strong reverse engineering and binary/code diffing skills, including against large codebases or binaries
• Expert-level understanding of networking, operating system internals for one or more major OSes, and/or bypassing common exploit mitigations
• A track record of writing about vulnerabilities and exploits for a public audience, and of speaking about your research at conferences, on webcasts, or similar venues
• The ability to build custom tooling as needed and to scope work into clear milestones rather than monolithic deliverables
• A willingness to mentor and teach. You don't need to be a people manager, but you should enjoy making the people around you better.
• Communicate in a clear manner that conveys objectives and rationale when explaining complex attack patterns and risks to technical stakeholders and detection engineers.
• Eager and open to understanding "why" a change is happening, acting as an active driver of it, and focusing forward versus in the past to tackle emerging threats.
• Hold self and others responsible for driving outcomes and meeting commitments that deliver value for the business and our customers by establishing ownership within research projects.
• Experience working cross-functionally during time-sensitive security events and translating technical findings for non-technical stakeholders
• Embody our core values to foster a culture of excellence that drives meaningful impact and collective success.
  

Nice to Have

• Published zero-day vulnerabilities and CVEs
• Prior contributions to the Metasploit Framework or other open source security projects
• Media training or experience speaking with journalists
• Experience applying AI or LLM-based tooling to accelerate vulnerability research or exploit development

We know that the best ideas and solutions come from multi-dimensional teams, reflecting a variety of backgrounds and professional experiences. If you're excited about this role and feel your experience can make an impact, please don't be shy. Apply today.

About Rapid7

At Rapid7, our vision is to create a secure digital world for our customers, our industry, and our communities. We do this by harnessing our collective expertise and passion to challenge what’s possible and drive extraordinary impact. We’re building a dynamic and collaborative workplace where new ideas are welcome.

Protecting 11,500+ customers against bad actors and threats means we’re continuing to push the envelope just like we’ ve been doing for the past 20 years. If you ’re ready to solve some of the toughest challenges in cybersecurity, we’re ready to help you take command of your career. Join us.

Rapid7, Inc. is committed to fair and equitable compensation practices. A candidate’s salary is determined by various factors including, but not limited to, relevant work experience, skills, and certifications. We evaluate compensation decisions on a case-by-case basis, and it is not typical for an individual to be hired at the very top of the salary range.

The annual salary range for this role, depending on location, is:

Salary ranges may vary based on geographical location. This range does not include variable/incentive compensation, equity and benefits (where applicable/eligible).

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status or any other status protected by applicable national, federal, state or local law.

About Us

Rapid7 is creating a more secure digital future for all by helping organizations strengthen their security programs in the face of accelerating digital transformation. Our portfolio of best-in-class solutions empowers security professionals to manage risk and eliminate threats across the entire threat landscape from apps to the cloud to traditional infrastructure to the dark web. We foster open source communities and cutting-edge research–using these insights to optimize our products and arm the global security community with the latest in attacker methodology. Trusted by more than 11,000 customers worldwide, our industry-leading solutions and services help businesses stay ahead of attackers, ahead of the competition, and future-ready for what’s next.