Rapid7 Senior Detection Operations Engineer 

United States, Virginia, Arlington 

451483903

About the Role

In this role, you will:

• Utilize Rapid7’s world-class software and threat intelligence to evaluate and improve the current InsightIDR detection library, including coordinating third-party integration projects.

• Collaborate closely with SOC Analysts, the Data Science team, Incident Response (IR) Consultants, Customer Advisors, and security researchers.

• Conduct research on attacker behaviors and techniques using information gathered from IR engagements, other incidents and malicious activity discovered through various telemetry sources.

• Conduct detection testing in a controlled environment.

• Collaborate with Rapid7’s Emergent Threat Response (ETR) team to ensure Rapid7 has detection coverage during large scale exploitation of vulnerabilities from recently disclosed zero days or CVEs.

• Utilize expert level skills in multiple security domains to build rules that detect or prevent evil across network, endpoint and cloud services.

The skills you’ll bring include:

• 5+ years as a SOC Analyst/Incident Responder/Offensive security practice experience OR 4+ years of cyber threat intelligence/research/detection engineering experience.

• Experience using industry Threat Intelligence Platforms.

• Experience writing detections using Yara/Suricata/Sigma or similar.

• Experience with hands-on analysis of forensic artifacts and/or malware samples.

• Conduct research using various OSINT methods.

• A solid understanding of how threat actors utilize tactics such as lateral movement, privilege escalation, defense evasion, persistence, command and control, and exfiltration.

• Effective collaboration between different teams.

• Innovative problem solving mindset.

• Strong ability to perform research (search for, organize, and evaluate information).

• Strong written and verbal skills.

Here, we’re building a dynamic workplace where everyone can have the career experience of a lifetime. We challenge ourselves to grow to our full potential. We learn from our missteps and celebrate our victories. We come to work every day to push boundaries in cybersecurity and keep our 11,000+ global customers ahead of whatever’s next.