Rapid7’s Managed Detection and Response (MDR) team provides 24/7 security monitoring, threat hunting, and incident investigation for organizations around the world. Our SOC operates with an impact-driven mindset focused on identifying meaningful threats and delivering actionable outcomes for our customers.

About the Team

Rapid7’s Managed Detection and Response (MDR) Security Operations Center delivers 24/7 continuous monitoring, threat hunting, and sophisticated incident response for global organizations. The team focuses on stopping adversary activity, elevating technical standards, and driving actionable security outcomes.

About the Role

As a Lead Detection & Response Analyst, your primary responsibility will be to serve as a high-level technical lead and driver of technical excellence across global SOC operations. Specifically, your focus will be to:

• Lead the response to high-impact, novel, or highly complex security threats.

• Develop new investigative methodologies for emerging attack vectors where established methods do not exist.

• Serve as the primary technical escalation point for the global SOC, directing containment and remediation strategies.

• Identify systemic visibility gaps and partner with Detection Engineering to prioritize high-fidelity defense capabilities.

• Architect and refine investigative workflows to leverage advanced tooling and automation.

• Author advanced technical intelligence reports and advisories for executive leadership and customers.

• Mentor and grow the technical bench strength of the SOC through high-level coaching and technical workshops.

• Influence product and platform direction by providing expert feedback to engineering teams.

The skills and qualities you'll bring include

• Bring 8+ years of cybersecurity operations, Incident Response, or Digital Forensics experience in a high-maturity SOC/MDR environment.

• Demonstrate expert-level mastery of the MITRE ATT&CK framework to build behavioral detection strategies.

• Apply deep forensic expertise across Endpoint, Cloud, Identity, and Network domains, including log analysis and malware triage.

• Drive complex technical projects from conception to completion across global teams.

• Direct containment strategies efficiently during high-stakes customer compromises to maintain momentum and resolve challenges.

• Articulate complex attacker TTPs and long-term security strategies clearly to technical engineers and C-level executives.

• Build cross-functional alignment with Detection Engineering, Product, and Platform teams to deliver sustainable defense capabilities.

• Mentor and coach analysts across the global SOC, setting clear expectations for investigative quality.

• Adapt to evolving adversary techniques by driving forward-looking investigative practices.

• Hold advanced industry certifications such as GCFA, GCTI, GREM, or OSCP.

• Embody our core values to foster a culture of excellence that drives meaningful impact and collective success.

We know that the best ideas and solutions come from multi-dimensional teams. That’s because these teams reflect a variety of backgrounds and professional experiences. If you are excited about this role and feel your experience can make an impact, please don’t be shy - apply today.