Senior Incident Responder
Rapid7 Incident Responders split their time between reactive breach response cases - supporting Rapid7 customers in their greatest time of need, and proactive customer engagements - delivering threat hunting and detection & response exercises with our customers' dedicated internal security teams. Rapid7 aims to provide unparalleled work/life balance that allows talented Detection & Response experts to thrive in a reactive Incident Response setting. Incident Responders help to impact the direction of Rapid7's Products and Services.
About the Team
The Rapid7 Incident Response team is considered the tip of the spear within Rapid7's Detection & Response practice. This team is primarily responsible for ensuring 24/7 breach response coverage for Rapid7's MDR and retainer customers to ensure they have Rapid7's unwavering support in their greatest times of need. All services are delivered using Rapid7's existing portfolio of detection and response solutions, such as Rapid7 InsightIDR and Velociraptor. The experiences gained by the members of this Managed Services team directly inform Rapid7's Product organization, driving continuous improvement of Rapid7 products for both Managed and standalone customers.
About the Role
Embedded within Rapid7 MDR SOC pods, the Senior Incident Responder's responsibilities in this role would primarily include incident management, which encompasses delegation of tasks, organizing the master timeline, and drafting customer deliverables. The Senior Incident Responder will also conduct incident handling as needed. The Senior Incident Responder will lead proactive engagements with Rapid7's customers. During peacetime, the Senior Incident Responder will focus on conducting continuous incident response research and service enablement through the improvement of internal processes, procedures, and methodologies used to deliver incident response services.
In this role, you will:
- Deliver world-class incident response services, leading customer engagements utilizing Rapid7 technologies like InsightIDR and Velociraptor
- Lead proactive threat hunting and compromise assessments of complex environments
- Lead incident simulations, helping clients assess their ability to respond to major threats within their existing toolsets
- Advise clients on security best practices and attack mitigation strategies using enterprise security controls
- Advise and mentor junior Incident Responders and MDR SOC analysts
- Assist in capturing and deploying knowledge of latest attacker methodologies
The skills you'll bring include:
- 2-3+ years of hands-on incident response experience, including leading and conducting technical incident response investigations
- Extensive experience in enterprise security and how various technologies work together for increasing threat detection and streamlining incident response including EDR, SIEM, Velociraptor, OSQuery, and other tools
- Strong technical experience in three of the six areas below
- Incident Management
- Host forensics (Windows / Mac / Linux)
- Network traffic analysis
- Log Review
- Malware triage
- Cloud technologies, including AWS, Azure, and GCP
- Ability to build relationships with, and understand business needs of, customers and deliver demonstrable value
- Outstanding verbal and written communication skills, in particular the ability to effectively communicate investigation findings and associated mitigation and remediation actions to technical and non-technical audiences, including executive leadership and legal counsel
- Proven ability to provide leadership to junior team members through job shadowing and mentoring
- Outstanding time management and prioritization skills
- Willingness to participate in an on-call rotation that may include evening/weekend work, as required
- Relevant industry certifications, such as, but not limited to: GCIA, GCIH, GDAT, GCFE, and GFCA
We know that the best ideas and solutions come from multi-dimensional teams. That's because these teams reflect a variety of backgrounds and professional experiences. If you are excited about this role and feel your experience can make an impact, please don't be shy - apply today.
About Rapid7
At Rapid7, we are on a mission to create a secure digital world for our customers, our industry, and our communities. We do this by embracing tenacity, passion, and collaboration to challenge what's possible and drive extraordinary impact.
Here, we're building a dynamic workplace where everyone can have the career experience of a lifetime. We challenge ourselves to grow to our full potential. We learn from our missteps and celebrate our victories. We come to work every day to push boundaries in cybersecurity and keep our 11,000+ global customers ahead of whatever's next.
Join us and bring your unique experiences and perspectives to tackle some of the world's biggest security challenges.
#LI-JM2
#LI-REMOTE
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status or any other status protected by applicable national, federal, state or local law.
