Sr Security Researcher

Senior Security Researcher - Metasploit

The Metasploit R+D team is responsible for growing the module repository that makes Metasploit Framework the world’s most popular exploitation framework, and for producing research on offensive techniques and trends that keep pushing the security ecosystem forward. Earlier this year, we released MSF 6.3 with new offensive capabilities. Now, we’re thinking about the content and features offensive practitioners need in MSF 7—from new exploits and innovative payloads to more intuitive targeting and stealthier movement within modern environments.

Want to help us get there? We’re hiring a senior security researcher to develop and innovate on Metasploit’s payload capabilities that underpin its collection of over 2,300 exploits. This researcher will help add novel post-exploitation techniques and improve compatibility with different target platforms and architectures.

About the Team

Rapid7 and the Metasploit community work together toward a shared vision for the future of the Metasploit Framework and its ecosystem. You will work with a talented global team to develop and maintain new payload capabilities for Framework, produce research on trends that pique interest from both offensive and defensive practitioners, and make substantial technical contributions as a key member of a cross-functional team. You will have the opportunity to diagnose and understand user needs directly. The community is your customer!

About the Role

As a Metasploit researcher you’ll need to balance development and security research and understand how each enhances the other. In this role, you will:

• Help develop and innovate Metasploit’s payload, session, and handler capabilities by driving internal development and working with the external community on related projects.

• Research emerging post-exploitation techniques and trends and work with Metasploit’s exploit developers to identify needs.

• Ensure that payloads work reliably and consistently in a variety of environments and obscure scenarios.

The skills you’ll bring include:

• Experience writing standalone RATs/C2 agents or contributing to existing C2 frameworks.

• Knowledge of Metasploit Framework. You understand what it's for and how to use it, and you have opinions on how to improve it. Strong opinions loosely held are some of our favorites.

• Ability to learn and dig into code. Metasploit Framework is comprised of more than a million lines of code contributed by hundreds of developers. Not everything is spelled out, but everything is discoverable.

• Experience with systems programming in multiple languages .NET, C, Assembly, Python or Ruby; while Ruby is not necessarily important as your primary language, it is important to be able to understand and extend the techniques that Metasploit embodies.

• Three years of experience in penetration testing, red teaming, or security research, and familiarity with the tooling and techniques used to advance these disciplines.

• Experience with using multiple communication protocols such as TCP, SMB, HTTP and developing APIs for interacting with them.

• Experience with development for Windows. Linux or OS X experience is a plus.

Ideally, you have a body of work you can point to that showcases your research and development interests. Have you published blogs or technical analysis of vulnerabilities, exploits, or techniques that interest you? Written purpose-built tools that made your life easier? Contributed to open-source projects? Show us what you're passionate about, where your curiosity lies, and how you've tried to pull things together to solve problems for yourself and others.

We know that the best ideas and solutions come from multi-dimensional teams. Teams reflecting a variety of backgrounds and professional experiences. If you are excited about this role and feel your experience can make an impact, please don’t be shy - apply today.

About Rapid7

Rapid7 is creating a more secure digital future for all by helping organizations strengthen their security programs in the face of accelerating digital transformation. Our portfolio of best-in-class solutions empowers security professionals to manage risk and eliminate threats across the entire threat landscape from apps to the cloud to traditional infrastructure to the dark web. We foster open source communities and cutting-edge research–using these insights to optimize our products and arm the global security community with the latest in attackers methods. Trusted by more than 10,000 customers worldwide, our industry-leading solutions and services help businesses stay ahead of attackers, ahead of the competition, and future-ready for what’s next.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status or any other status protected by applicable national, federal, state or local law.