Rapid7 Security Researcher - Metasploit 

Czechia, Prague, Prague 

403024710

The Metasploit R+D team is responsible for growing the module repository that makes Metasploit Framework the world’s most popular exploitation framework, and for producing research on offensive techniques and trends that keep pushing the security ecosystem forward. This year, we released MSF 6.4 with new offensive capabilities. Now, we’re thinking about the content and features offensive practitioners need in MSF 7—from new exploits and innovative payloads to more intuitive targeting and stealthier movement within modern environments.

About the Role

As a Metasploit researcher you’ll need to balance module development and security research and understand how each enhances the other. A good mix of skills includes:

• Knowledge of Metasploit Framework. You understand what it's for and how to use it, and you have opinions on how to develop module content that makes it better. Strong opinions loosely-held are some of our favorites.

• Experience writing standalone PoCs or Metasploit modules. Experience in penetration testing, red teaming, mobile security, or security research is a plus, as is familiarity with the tooling and techniques used to advance these disciplines.

• Experience with Ruby, Python, or Go is a major plus; while Ruby is not necessarily important as your primary language, it is important to be able to understand and extend the techniques that Metasploit embodies.

• Experience with common vulnerability classes such as buffer overflows, command injection, and insecure deserialization.

• Conversant in distributed and open-source project development. You can review, merge, and rebase with aplomb.

• Interest in vuln analysis, fuzzing, reverse engineering, and/or advanced exploitation techniques; familiarity with tools such as WinDBG, GDB, IDA Pro, Burp Suite, etc.

• Understanding of modern security mitigations and how to bypass them (e.g., stack cookies, SafeSEH, DEP, ASLR, CFG, and so on).

• Soft Skills (just as important as technical skills)

• Interest in hacking and hacker culture, genuine curiosity about how things work, and willingness to figure stuff out.

• Ability to learn and dig into code. Metasploit Framework is comprised of more than a million lines of code contributed by hundreds of developers. Not everything is spelled out, but everything is discoverable.

• Ability to learn and evaluate new technologies quickly. You’re comfortable with and excited about experimentation and uncertainty. The R+D team encounters and analyzes lots of artifacts and oddities on a regular basis: CVEs, PoC, vulnerable applications, vendor patches, blogs, pastes, Twitter threads, stack traces, error messages, you name it. You’ll bring and hone an instinct for when something belongs in Framework, how to best incorporate it (e.g., module, library, integration?), and what strikes a balance between “intuitive for users” and “maintainable for developers.”

• Ability to work asynchronously and directly with a team of co-workers and volunteers from around the globe.