Security Researcher, Vulnerability Research; Emergent Threat Response & Metasploit

Rapid7's vulnerability intelligence team does industry-leading offensive research that helps organizations worldwide understand and prioritize real risk. When a critical vulnerability starts getting exploited in the wild, we're the team that figures out what's actually happening, how bad it is, and what defenders need to do about it. We're looking for an experienced vulnerability researcher to help lead that work, with a strong focus on rapid n-day analysis and on making Metasploit better for the security community.

Rapid7 vulnerability researchers analyze high-priority n-day vulnerabilities, write Metasploit modules, find and publish zero-day vulnerabilities, and help customers, the media, internal teams, and the public understand which threats matter and why. We drive Rapid7's company-wide Emergent Threat Response (ETR) program, coordinating our research, product coverage, and customer guidance when widespread attacks hit. We aren't satisfied with being purely reactive, though. We also look for the vulnerabilities and attack patterns that will become tomorrow's widespread threats.

This role sits at the Staff level, a senior technical leadership position on our individual contributor track. Your time will be focused primarily on Emergent Threat Response and Metasploit, with zero-day research as a secondary focus.

• Rapidly analyze newly disclosed and actively exploited vulnerabilities, often under tight timelines, to determine root cause, exploitability, and real-world impact
• Reproduce vulnerabilities and build working exploits from patch diffs, advisories, and limited public information, documenting behavioral differences across affected versions and platforms
• Publish clear, technically rigorous root cause analyses that help defenders act quickly and reflect Rapid7's attacker-focused approach to vulnerability intelligence
• Advise detection and vulnerability check engineers as they build coverage, and help internal teams and customers understand what's urgent, what isn't, and why
• Serve as a go-to expert during high-velocity events (think Log4
  
  Shell), knowing when to raise alarms and when to counsel patience

• Develop and contribute high-quality exploit modules to Metasploit, especially for high-priority vulnerabilities coming out of ETR work
• Drive improvements to the Metasploit Framework itself, including new capabilities, tooling, library enhancements, and quality improvements that make the framework more effective for researchers and practitioners
• Review community and internal module contributions, raising the bar for code qua
• lity, reliability, and stability across the project
• Partner with the Metasploit engineering team on roadmap priorities and help shape where the framework goes next

• Identify and research, new vulnerabilities in technologies that matter to enterprise organizations
• Help define longer-term research priorities with the broader team, bringing a point of view on emerging attack surface

• Contribute technical trend analysis to Rapid7's research reports and publications
• Represent the team's work through conference talks, webcasts, blog posts, and media engagements
• Mentor and develop other researchers through code review, pairing, documentation, and technical guidance
• Explain technical risk clearly to audiences ranging from engineers to executives

• Demonstrable expertise across most major vulnerability classes and exploitation techniques, with the ability to reproduce vulnerabilities and attacks quickly and effectively
• Experience developing complex exploit chains from scratch, including from…