[Hiring] Staff Security Researcher @Rapid7

Role Description

Rapid7's vulnerability intelligence team does industry-leading offensive research that helps organizations worldwide understand and prioritize real risk. We're looking for an experienced vulnerability researcher to help lead that work, with a strong focus on rapid n-day analysis and on making Metasploit better for the security community.

About the Team

• Analyze high-priority n-day vulnerabilities.
• Write Metasploit modules.
• Find and publish zero-day vulnerabilities.
• Help customers, the media, internal teams, and the public understand which threats matter and why.
• Drive Rapid7's Emergent Threat Response (ETR) program.
• Look for vulnerabilities and attack patterns that will become tomorrow's widespread threats.

About the Role

This role sits at the Staff level, a senior technical leadership position on our individual contributor track. Your time will be focused primarily on Emergent Threat Response and Metasploit, with zero-day research as a secondary focus.

Primary Focus: Emergent Threat Response (n-day research)

• Rapidly analyze newly disclosed and actively exploited vulnerabilities.
• Determine root cause, exploitability, and real-world impact.
• Reproduce vulnerabilities and build working exploits from patch diffs, advisories, and limited public information.
• Publish clear, technically rigorous root cause analyses.
• Advise detection and vulnerability check engineers.
• Serve as a go-to expert during high-velocity events.

Primary Focus: Metasploit

• Develop and contribute high-quality exploit modules to Metasploit.
• Drive improvements to the Metasploit Framework.
• Review community and internal module contributions.
• Partner with the Metasploit engineering team on roadmap priorities.

Secondary Focus: Zero-day research

• Identify and research new vulnerabilities in technologies that matter to enterprise organizations.
• Help define longer-term research priorities with the broader team.

Across all of it

• Contribute technical trend analysis to Rapid7's research reports and publications.
• Represent the team's work through conference talks, webcasts, blog posts, and media engagements.
• Mentor and develop other researchers.
• Explain technical risk clearly to various audiences.

Qualifications

• Demonstrable expertise across most major vulnerability classes and exploitation techniques.
• Experience developing complex exploit chains from scratch.
• Strong reverse engineering and binary/code diffing skills.
• Expert-level understanding of networking and operating system internals.
• A track record of writing about vulnerabilities and exploits for a public audience.
• The ability to build custom tooling as needed.
• A willingness to mentor and teach.
• Clear communication skills for explaining complex attack patterns.
• Eager to understand changes and focus on emerging threats.
• Hold self and others responsible for driving outcomes.
• Experience working cross-functionally during time-sensitive security events.
• Embody core values to foster a culture of excellence.

Nice to Have

• Published zero-day vulnerabilities and CVEs.
• Prior contributions to the Metasploit Framework or other open source security projects.
• Media training or experience speaking with journalists.
• Experience applying AI or LLM-based tooling to accelerate research.

Benefits

• Competitive salary based on experience and location.
• Variable/incentive compensation, equity, and benefits (where applicable).

Company Description

At Rapid7, our vision is to create a secure digital world for our customers, our industry, and our communities. We do this by harnessing our collective expertise and passion to challenge what’s possible and drive extraordinary impact.