Rapid7 is seeking a Lead Product Manager, AI-SOC to define and execute the strategy powering our autonomous investigation platform. This domain-first role owns everything the investigation agent knows and does, translating deep Detection & Response expertise into a high-impact product roadmap.
As a Lead Product Manager, AI-SOC, your primary responsibility will be to own the content layer that determines what the autonomous agent investigates, how it investigates, and what it concludes. Specifically, your focus will be to:
- Define and maintain the full library of investigation playbooks and queries executed across alert types, data sources, and severities, owning the continuous improvement backlog.
- Establish telemetry and schema requirements for onboarding new log sources and alert integrations in direct partnership with engineering and data teams.
- Own the status disposition logic and suppression framework, guiding the evolution from rule-based heuristics to an advanced ML-driven disposition engine.
- Incorporate threat intelligence, including IOC matching, actor context, and TTP enrichment, into autonomous investigation workflows.
- Establish and track core quality metrics, including coverage rate, disposition accuracy, and false positive rates, leveraging feedback loops from MDR analysts.
- Partner with MDR operations to ensure autonomous investigation output consistently meets the quality bar required to replace manual Tier 1-2 triage at scale.
The skills and qualities you'll bring include:
- Bring 7+ years of experience in security operations, alert triage, detection engineering, or security engineering within an MDR, MSSP, or enterprise SOC environment.
- Demonstrate deep working knowledge of Detection & Response across multiple technical domains, including endpoint, network, identity, cloud, or SaaS/email.
- Apply direct experience with major EDR/XDR platforms to write queries, review telemetry, and render defensible disposition decisions.
- Leverage strong proficiency in investigation methodology and the MITRE ATT&CK framework to map alert types to adversary behaviors.
- Demonstrate 2+ years in product management or equivalent SOC leadership where domain expertise was translated into clear engineering requirements.
- Drive efficient decision-making that resolves complex product challenges and enables operational momentum across diverse stakeholder groups.
- Establish clear ownership and accountability for delivery outcomes, quality metrics, and operational commitments.
- Build global cross-functional networks across engineering, data science, and security operations to drive sustainable platform enhancements.
- Act as an active driver of change when transitioning legacy operations toward AI-driven autonomous workflows.
- Bring strong written and verbal communication skills to align cross-functional partners and executive stakeholders around vision and execution.
- Possess US Citizenship with active or prior security clearance experience in federal or government environments.
- Embody our core values to foster a culture of excellence that drives meaningful impact and collective success.
We know that the best ideas and solutions come from multi-dimensional teams. That's because these teams reflect a variety of backgrounds and professional experiences. If you are excited about this role and feel your experience can make an impact, please don't be shy - apply today.
#LI-TD1#LI-Remote
