About this role
Define and execute strategy for Rapid7's autonomous investigation platform, translating Detection & Response expertise into a high-impact product roadmap. Own the content layer that determines what the AI agent investigates, how it investigates, and what it concludes.
Must have
7+ years experience in security operations, alert triage, detection engineering, or security engineering within MDR, MSSP, or enterprise SOC
Deep working knowledge of Detection & Response across endpoint, network, identity, cloud, or SaaS/email domains
Direct experience with major EDR/XDR platforms to write queries and review telemetry
Strong proficiency in investigation methodology and MITRE ATT&CK framework
2+ years in product management or SOC leadership translating domain expertise into engineering requirements
US Citizenship with active or prior security clearance experience in federal or government environments
Technologies
Responsibilities
Define and maintain the full library of investigation playbooks and queries across alert types, data sources, and severities
Establish telemetry and schema requirements for onboarding new log sources and alert integrations with engineering and data teams
Own the status disposition logic and suppression framework, evolving from rule-based heuristics to ML-driven disposition engine
Incorporate threat intelligence including IOC matching, actor context, and TTP enrichment into autonomous investigation workflows
Establish and track core quality metrics including coverage rate, disposition accuracy, and false positive rates
Partner with MDR operations to ensure autonomous investigation output replaces manual Tier 1-2 triage at scale
Benefits
Recruitment process
Role sits within Rapid7's Detection & Response organization building autonomous investigation platform for MDR service
Operates at intersection of managed security operations and agentic AI
Requires building global cross-functional networks across engineering, data science, and security operations
Active driver of change transitioning legacy operations toward AI-driven autonomous workflows
Similar offers
Sr. Security Engineer I - Enterprise Security
135,482 – 227,700 USD
/ year
Sr. Analyst, Falcon Complete (Remote, CAN)
125,000 – 200,000 CAD
/ year
Senior Solutions Engineer - Partners
335,000 – 335,000 CAD
/ year
Staff CIAM Security Engineer
181,000 – 241,000 CAD
/ year
Senior IT Auditor
119,200 – 165,500 USD
/ year