Lead Incident Responder

Lead Incident Responder
Do you enjoy being in the fight, investigating unusual activity, tearing apart malware, and chasing attackers in real time? Do you pride yourself on developing methods for identifying and analyzing breaches? Do you feel compelled to help organizations improve their abilities to effectively detect threats and drive incident response?
Rapid7's Detection & Response Services team offers the opportunity to respond to active incidents, uncover previously unidentified breaches, and work with clients to simulate full-scale incidents in their own environments. Our Incident Responders pride themselves on their ability to think critically, adapt to constantly changing attack methodologies, deliver top-notch Incident Response services, and help our customers improve their programs.
About the Role
Rapid7 Incident Responders split their time between reactive breach response cases - supporting Rapid7 customers, and others, in their greatest time of need, and proactive customer engagements - delivering threat hunting and detection & response exercises with our customers' dedicated internal security teams. Rapid7 aims to provide unparalleled work/life balance that allows talented experts to thrive in a reactive Incident Response setting. Incident Responders help to impact the direction of Rapid7's Products and Services.
In this role, you will:

• Be responsible for the daily oversight and consistent delivery of multiple proactive and reactive incident response service engagements
• Provide expert guidance and support to Incident Responders and Customer Advisors, delivering timely and constructive performance feedback, and serving as an escalation point during engagements
• Focus on technical and procedural service delivery improvements through a variety of initiatives that may include a variety of development, engineering, training, and enablement responsibilities
• Proactively maintain awareness of, and educate internal teams on, the latest attacker TTPs and the appropriate response techniques required to properly investigate them.
• Execute on responsibilities as part of Rapid7's Emergent Threat Response program
• Scope prospective proactive and reactive incident response service engagements
• Participate in pre-sales conversations with prospective customers, Sales enablement sessions, and other methods of driving business in your respective region
• Liaison with external legal counsel, cyber insurance carriers, and other third party resources to ensure customer expectations are met
• Lead and assist with incident response engagements, as necessary

The skills you'll bring include:

• 3-5+ years of hands-on incident response experience, including leading and conducting technical incident response investigations
• Extensive experience in enterprise security and how various technologies work together for increasing threat detection and streamlining incident response including EDR, SIEM, Velociraptor, OSQuery, and other tools
• Strong technical experience in four of the six areas below
  
  • Incident Management
  • Host forensics (Windows / Mac / Linux)
  • Network traffic analysis
  • Log Review
  • Malware triage
  • Cloud technologies, including AWS, Azure, and GCP
• Ability to build relationships with, and understand business needs of, customers and deliver demonstrable value
• Outstanding verbal and written communication skills, in particular the ability to effectively communicate investigation findings and associated mitigation and remediation actions to technical and non-technical audiences, including executive leadership and legal counsel
• Proven ability to provide leadership to junior team members through job shadowing and mentoring
• Highly self-motivated and self-directed, outstanding time management and prioritization skills
• Willingness to participate in an on-call rotation that may include evening/weekend work, as required
• Relevant industry certifications, such as, but not limited to: GCIA, GCIH, GDAT, GCFE, and GFCA

We know that the best ideas and solutions come from multi-dimensional teams. That's because these teams reflect a variety of backgrounds and professional experiences. If you are excited about this role and feel your experience can make an impact, please don't be shy - apply today.
About Rapid7
At Rapid7, we are on a mission to create a secure digital world for our customers, our industry, and our communities. We do this by embracing tenacity, passion, and collaboration to challenge what's possible and drive extraordinary impact.
Here, we're building a dynamic workplace where everyone can have the career experience of a lifetime. We challenge ourselves to grow to our full potential. We learn from our missteps and celebrate our victories. We come to work every day to push boundaries in cybersecurity and keep our 10,000 global customers ahead of whatever's next.
Join us and bring your unique experiences and perspectives to tackle some of the world's biggest security challenges.
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status or any other status protected by applicable national, federal, state or local law.