R

Rapid7

Provides cloud-based security analytics and automation

Vice President, Program Management Office

Full-TimeUpdated on 10/20/2026
$263.5k - $356.5k/yr+ Variable/incentive compensation + Equity
Expert
San Francisco, CA, USA
In Person
Project & Program ManagementProgram Management

About the job

Requirements
  • Demonstrated mastery in steering complex technical program portfolios, software delivery operations, or engineering-focused PMO structures within enterprise SaaS ecosystems.
  • Deep expertise implementing scalable product delivery lifecycles, developer capacity optimization models, and agile engineering analytics infrastructure.
  • Ability to translate complex product visions into structured, time-bound technical sprints and actionable engineering milestones.
  • Commitment to establishing clear development ownership parameters, joint team milestones, and transparent software release expectations.
  • Openness to driving engineering operational change and keeping developers and product partners aligned to forward-looking delivery commitments.
  • Ability to make rapid technical trade-off decisions that maintain code-shipping momentum while evaluating diverse product and architectural inputs.
  • Ability to communicate technical program roadmaps and resource constraints as clear business rationale for cross-functional partners.
  • Experience cultivating a global engineering and product management network across corporate lines to deliver integrated, scalable platform updates.
  • Ability to evaluate technical squad health and adapt leadership and process styles to resolve architectural or team friction.
Responsibilities
  • Design the technical program management strategy to accelerate the software release lifecycle across multiple cloud-native product lines.
  • Serve as the single source of truth for delivery timelines for the R&D organization.
  • Lead a strategic team of technical program managers, scrum masters, and equivalent delivery roles, embedding them as strategic partners across engineering squads to drive execution and alignment.
  • Synchronize product roadmaps with engineering architecture dependencies to maximize developer throughput and minimize delivery blockages.
  • Oversee capacity planning, technical metric analysis, and cross-team development velocity dashboards for the engineering leadership team.
  • Establish data-driven framework metrics focused on code-to-production speed, development cycle predictability, and product roadmap milestone adherence.
  • Mitigate product development operational risks by introducing proactive early-warning mechanisms for engineering bottlenecks and architectural blockers.
  • Lead cross-functional alignment initiatives across product boundaries to establish unified agile cadences, shared engineering release criteria, and seamless delivery pipelines.

About the company

R

Rapid7

View
Website

Rapid7 provides cloud-based tools for visibility, analytics, and automation to help security teams protect organizations. Its Insight Cloud collects telemetry from networks and systems to identify vulnerabilities, detect malicious activity, investigate incidents, and automate tasks. The company combines threat analytics, vulnerability management, and security automation in a single platform, sold via subscriptions to enterprises and government agencies worldwide. Unlike some competitors with separate tools, Rapid7 focuses on an integrated cloud-native platform that automates routine security work to improve efficiency and incident response.

Company Size

1,001-5,000

Company Stage

IPO

Headquarters

Boston, Massachusetts

Founded

2000

Get referred to Rapid7

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • Q2 2026 revenue hit $210.9 million, and non-GAAP EPS reached $0.44.
  • Licencias OnLine expands Latin American channel reach across cloud and government buyers.
  • Rapid7 Intelligence launched October 2, 2026, converting vulnerability research into product actions.

What critics are saying

  • ARR fell 2% to $824 million in Q2 2026, signaling demand erosion.
  • Rapid7 cut 314 jobs in 2026; execution risk rises through Q4 integration.
  • Elastic, CrowdStrike, and Palo Alto pressure Rapid7's core platform; share losses can persist.

What makes Rapid7 unique

  • Oct. 2, 2026 Intelligence fuses Labs research, MDR, and Exposure Management into one engine.
  • March 26, 2026 Kenzo acquisition adds agentic AI investigations at machine speed.
  • 11,500 customers worldwide and open-source Metasploit anchor Rapid7's community-led reputation.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Health Insurance
  • Dental Insurance
  • Vision Insurance
  • Unlimited Paid Time Off
  • Flexible Work Hours
  • Remote Work Options
  • Paid Vacation
  • Paid Holidays
  • Sabbatical Leave
  • Company Equity
  • Stock Options
  • 401(k) Retirement Plan

Growth & Insights and Company News

Headcount

6 month growth

0%

1 year growth

0%

2 year growth

0%
SparTech Software
Oct 3rd, 2026
BPFDoor, AVERAT Linux implants stalk telecom edge.

BPFDoor, AVERAT Linux implants stalk telecom edge. Rapid7 Intelligence has disclosed a new modular Linux malware ecosystem that fuses fresh BPFDoor variants, a BPF-based Rekoobe build, and a novel AVERAT implant to compromise telecom and network-edge infrastructure in South Korea and Taiwan.[[1]] [[2]] [[11]] The campaigns concentrate on mail and security appliances at the perimeter, pushing command-and-control over SMTP and blending into legitimate mail flows to stay below the radar of conventional network monitoring.[[1]] [[2]] [[4]] Researchers report that the operators rely on a Linux dropper that writes a shell script to targeted appliances, staging two binaries under innocuous daemon names such as ntpdate and udevds in /sbin before deleting the files while leaving the processes resident in memory.[[1]] One payload re-executes as a watchdog to maintain persistence without an on-disk footprint, while the other carries either an AVERAT implant or a BPFDoor variant customized to the vendor platform and role of the device.[[1]] [[4]] In the South Korean cluster, the dropper derives its encryption key from the string ShareTech and resides in the appliance's add-on package directory, while BPFDoor samples spoof local SpamSniper antispam software by impersonating its PID file and rotating through benign-looking Linux daemon identities.[[1]] [[4]] A parallel cluster targets Taiwanese appliances with six AVERAT builds that adopt process names and configuration paths matching regional telecom and edge vendors, highlighting the operators' detailed knowledge of their victims' software stacks.[[1]] [[2]] Rapid7's reconstruction of the BPFDoor controller source code shows the backdoor evolving from raw Layer 4 "magic bytes" in TCP and UDP headers to HTTP-tunneled triggers wrapped in ordinary-looking HTTPS POST requests traversing edge proxies in telecom environments.[[1]] [[3]] [[15]] Because proxies add and modify HTTP headers such as X-Forwarded-For and alter User-Agent lengths, the controller can no longer rely on fixed byte offsets; instead it sends mathematically padded requests like POST /admin/login.aspx?id=99990 so that the string 9999 consistently lands at a known position, then uses that marker to locate the rnrn separator and extract a hex-encoded command payload from the HTTP body.[[1]] [[3]] The controller's dogetlogin function hard-codes realistic web login paths to blend into logs, while the running process spoofs /usr/sbin/abrtd via Linux prctl calls, applying the disguise only on non-Solaris systems.[[1]] [[15]] Newly documented flags add HTTPS POST tunneling, hidden IP fields, custom URI directories, and verbose debug output on top of older ICMP, UDP, and raw TCP trigger modes, giving operators flexible ways to activate implants and pivot within compromised networks.[[1]] [[3]] On the data plane, one newly observed BPFDoor variant creates a raw PF_PACKET socket and attaches a classic BPF filter that matches specific "magic" byte sequences in UDP, TCP, and ICMP traffic before opening shells or performing UDP knocks, depending on the password embedded in the trigger packet.[[1]] Strings inside the binary are obfuscated with a rotating substitution alphabet, but once decoded they reveal explicit product spoofing artifacts and a suite of process-name disguises that mimic common Linux daemons such as chronyd, rsyslogd, crond, and NetworkManager, alongside mutex references to /var/run/spamsniper.pid that tie the build to SpamSniper-protected mail and telecom environments in South Korea.[[1]] [[4]] A separate sample gates on a unique 14-byte payload via a 16-instruction BPF program and spoofs its identity as ora_ppmond, echoing Oracle-backed HSS and OSS/BSS platforms used by telecom providers so that the implant looks legitimate only on hosts actually running that class of infrastructure.[[1]] [[2]] Elsewhere, BPFDoor activity has been linked to the China-nexus group sometimes described as Red Menshen, but Rapid7 has not publicly pinned this latest SMTP-focused edge campaign to a specific threat actor.[[7]] [[8]] [[15]] The AVERAT implants themselves are described as modular Linux remote access tools that favor SMTP over port 25 for command-and-control, allowing attackers to hide lateral movement and exfiltration inside the same mail security traffic defenders expect to see near the network core.[[1]] [[2]] [[4]] According to independent reporting, these operations also abuse compromised consumer and small-business appliances - including NAS devices, DVRs, and broadband gateways - as relays and persistence nodes, extending the reach of the ecosystem beyond traditional carrier gear into adjacent infrastructure.[[2]] [[11]] That mix of fileless execution, vendor-specific process spoofing, passive BPF listeners, and mail-based C2 means conventional port-centric monitoring and simple process name checks are unlikely to surface the implants without more targeted hunting.[[1]] [[3]] [[9]] Rapid7 and other security firms have released BPFDoor detection scripts and guidance that focus on kernel-level BPF hooks, suspicious raw socket usage, anomalous process-command-line combinations, and unusual DNS, ICMP, or SMTP patterns, and telecom operators are being urged to apply those tools across edge proxies, mail gateways, and embedded devices as part of focused threat hunting and incident response.[[3]] [[9]] [[12]] Compare Security

Associated Press
Oct 2nd, 2026
Rapid7 launches Intelligence platform to transform threat defenses from reactive to proactive

Rapid7 has launched Rapid7 Intelligence, a unified engine designed to transform enterprise threat defenses from reactive monitoring to proactive prevention. The platform combines threat intelligence, vulnerability research, and the legacy of Rapid7 Labs to turn insights on attacker behaviour into AI-powered action. The company tracked 8,539 critical vulnerabilities in Q2 alone. Rapid7 Intelligence monitors threats in real time to deliver actionable, expert-validated insights. Rapid7 researchers recently uncovered a modular Linux malware ecosystem targeting telecom and network-edge devices. The discovery demonstrates the platform's ability to analyse shared behaviours and uncover emerging attack patterns. The intelligence flows directly into Rapid7 products, MDR, and Exposure Management to neutralise adversary infrastructure before attacks execute. Rapid7 serves more than 11,500 customers worldwide.

TMCnet
Oct 2nd, 2026
Rapid7 Launches Rapid7 Intelligence to Harness Threat Data Against Attackers

Rapid7 Launches Rapid7 Intelligence to Harness Threat Data Against Attackers TMCnet News [October 02, 2026] | / | Rapid7 Launches Rapid7 Intelligence to Harness Threat Data Against Attackers BOSTON, Oct. 02, 2026 (GLOBE NEWSWIRE) - Today, Rapid7, Inc. (NASDAQ: RPD), a global leader in AI-powered managed cybersecurity operations, announced the launch of Rapid7 Intelligence, a unified engine designed to transform enterprise threat defenses from reactive monitoring to proactive prevention. By combining threat intelligence, vulnerability research, and the legacy of Rapid7 Labs, Rapid7 Intelligence transforms insights on attacker behavior into AI-powered action to help organizations anticipate and disrupt attacks. Indicators Expire. Behavior Doesn't: Defense for the Agentic Era. Building on Rapid7 Labs' 13-year legacy, Rapid7 Intelligence turns attacker behavior into scalable protection faster than traditional vendors reliant on static indicators. With AI compressing exploitation windows to minutes - and 8,539 critical vulnerabilities tracked in Q2 alone - attackers are leveraging automation to scale phishing, reconnaissance, and script development. Rapid7 Intelligence monitors these threats in real time to deliver actionable, expert-validated insights that keep defenders ahead. "Static threat intelligence isn't completely dead - it's just sitting in standard dashboards doing what it's always done, giving organizations a false sense of security while autonomous threat agents burn down their perimeters," said Christiaan Beek, Vice President of Rapid7 Intelligence. "The real differentiator isn't hoarding more raw feeds; it's having curated, vetted intelligence focused relentlessly on true signals rather than waiting around for alerts to trigger after the damage is done. Rapid7 Intelligence isn't built to generate another 50-page PDF report for security teams to ignore; it aggressively converts real-time operational adversary insight into a proactive, preemptive shield." Rapid7 Intelligence in Action: Behavioral Correlation Exposes a Hidden Linux Malware Ecosystem A concrete illustration of Rapid7 Intelligence's power is a new finding from Rapid7 researchers, who uncovered a modular Linux malware ecosystem - spanning new BPFDoor variants, BPF Rekoobe, droppers, and AVERAT implants - actively targeting telecom and network-edge devices. Researchers identified two campaigns linked by a common focus on the network edge. Rapid7 Intelligence analyzed their shared behaviors, uncovering an emerging pattern: using SMTP to blend into the victim's DMZ, target mail security appliances, and maintain long-term access. New BPFDoor variants indicate the malware family is evolving into an ecosystem where each sample is tailored to the telco plane (control, management, and data plane) it targets, and where threat actors know exactly what software is adopted at each layer. Rapid7 Intelligence will continue tracking and disrupting tactics like this to keep defenders ahead of attackers. Expert-Led, Actionable Intelligence To continuously power research like this and help defenders stay ahead of emerging threats, Rapid7 Intelligence delivers: * Immediate Protective Force: Frontline intelligence bypasses legacy research lags, flowing directly into Rapid7 products, MDR, and Exposure Management to neutralize adversary infrastructure before attacks execute. * Unified Intelligence Engine: Threat intelligence, vulnerability analysis, and engineering inside the products customers already run, instead of a report they have to translate into action themselves. * Uncompromised Community Arsenal: Building on the legendary foundation of Metasploit and Rapid7 Labs, critical advisories, vulnerability research and exploitation insights remain open, ensuring the industry stays capable of pushing back. "In a world of infinite telemetry and automated attacks, playing defense with traditional tools is an exercise in futility," said Mel Stone, Chief Global Services Officer at Rapid7. "Rapid7 Intelligence shifts the balance of power. By fusing machine-scale observation with frontline human expertise, we turn raw threat data into immediate, actionable intelligence - empowering security teams to disrupt adversaries before they establish a foothold." To learn more about Rapid7 Intelligence, visit here. About Rapid7 Rapid7, Inc. (NASDAQ: RPD) is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers. As a recognized leader in preemptive managed detection and response (MDR), Rapid7 unifies exposure and detection to transform the cybersecurity operations of more than 11,500 customers worldwide. For more information, visit its website, check out its blog, or follow Fog Computing World on LinkedIn or X. Media Contact Christine Nurnberger SVP Global Marketing and Growth [email protected] Rapid7 Investor Contact Christopher Keenan Vice President, Deputy General Counsel [email protected] [ Back To TMCnet.com's Homepage] |

Rapid7
Sep 23rd, 2026
How dynamic application security testing validates risk at runtime.

How dynamic application security testing validates risk at runtime. Security teams already have long queues of potential application vulnerabilities. The useful question is what happens next: can they see how a weakness behaves in a running application, reproduce the attack, and give developers enough evidence to fix it? Dynamic application security testing (DAST) helps answer those questions by testing applications as an attacker encounters them. The IDC MarketScape: Worldwide Dynamic Application Security Testing 2026 Vendor Assessment (Doc #US54119126, September 2026). The IDC MarketScape evaluated 16 vendors and named Rapid7 a Leader. Rapid7 believe the result reflects the strength of Rapid7's DAST capabilities, but the IDC MarketScape also offers a useful view of where the category is heading. DAST has developed beyond traditional web scanning into a source of runtime evidence that can help organizations validate risk across the application layer. From possible weakness to validated application risk. Code analysis and dependency scanning help teams identify weaknesses before an application is deployed. DAST provides a different view by interacting with the assembled application while it is running. It can show what happens when a particular request reaches the application, how the application responds, and whether a suspected weakness can be reproduced. This is especially valuable for APIs and AI-backed applications, where risk may emerge through interactions among models, prompts, data, tools, and permissions. Some of these behaviors cannot be fully understood from source code or a dependency manifest. They become visible when the application is exercised under runtime conditions. DAST therefore has a direct role in continuous threat exposure management (CTEM). Discovery gives teams a view of their assets and possible weaknesses, but that view alone does not tell them where to focus. Validation helps narrow the field by showing which exposures can be reached or exploited and providing evidence that teams can use to take action. For Rapid7, DAST is exposure management applied to the application layer. Web applications, APIs, and AI-backed endpoints are all part of the attack surface, so they need to be discovered, tested, prioritized, and managed alongside infrastructure, cloud, and other exposures. Why Rapid7 believe Rapid7 was named a Leader by IDC. Rapid7's DAST solution is delivered as part of the Exposure Command portfolio. Its scan engine maps an application, executes attacks against the discovered paths, and validates confirmed findings. Security teams can map a broad area of an application while limiting active attacks to an appropriate set of paths, giving them control over how testing is performed. Findings are checked against Rapid7 telemetry to help determine which issues warrant closer attention. When a finding needs action, browser-based replay reproduces the original request, the attack request, and the triggering response. Developers receive evidence they can work with, rather than a finding they must first spend time proving. Authenticated scanning can be difficult to maintain across a changing application portfolio, and a broken login sequence can leave important areas untested. Rapid7's solution can identify the affected step and support a targeted update without requiring the entire sequence to be recorded again. The connection with Surface Command adds another useful layer. Newly discovered external assets can be surfaced for application testing, helping teams close the gap between finding an application and understanding the risk it presents DAST plays a core role within Exposure Command: providing the application-layer validation teams need to prioritize risk and move from findings to remediation.

Rapid7
Aug 19th, 2026
Rapid7 and Licencias OnLine partner to accelerate cybersecurity maturity across Latin America.

Rapid7 and Licencias OnLine partner to accelerate cybersecurity maturity across Latin America. Cássio De Alcântara is Director, LATAM Sales at Rapid7. Across Latin America, organizations are embracing cloud, AI, and digital transformation to drive innovation and business growth. These technologies create new opportunities, but also introduce greater complexity and expanding attack surfaces. In this environment, security leaders are being asked to understand where risk exists across increasingly distributed environments and quickly eliminate blind spots like Shadow IT and Shadow AI - all without adding operational complexity. To help security leaders and practitioners address this complexity, Rapid7 is excited to announce a new strategic distribution partnership with Licencias OnLine (LOL) across Latin America. Helping organizations stay ahead of evolving threats. In order to keep day-to-day business operations moving, organizations need security solutions that not only protect critical assets but also support innovation, regulatory compliance, and long-term digital transformation. Rapid7's AI-powered cybersecurity operations platform helps organizations strengthen cyber resilience by unifying continuous exposure management, AI-driven threat detection and response, and security automation. By connecting security data across endpoint, cloud, identity, and infrastructure environments, organizations leverage one platform to gain the visibility to reduce risk and act with confidence. A shared commitment to partner success. Success in today's fragmented cybersecurity environments depends on a strong ecosystem of partners who can help organizations implement, optimize, and maximize the value of unified security operations. This is where Licencias OnLine comes in. With a strong, well-established presence across Latin America, deep cybersecurity expertise, and a highly specialized channel ecosystem, Licencias OnLine brings the local knowledge, technical enablement, and operational agility needed to help partners grow their cybersecurity practices and deliver greater value to customers. Together, Rapid7 and Licencias OnLine will invest in technical training, partner enablement, joint marketing initiatives, and go-to-market programs that help partners expand managed security services, strengthen customer relationships, and accelerate business growth across the region. Building cyber resilience together. As organizations across Latin America continue to modernize their IT environments, they should have access to security operations that are integrated, intelligent, and designed for today's AI-powered threat landscape. Rapid7's open platform supports this approach through hundreds of technology integrations that help organizations eliminate security silos, improve visibility across their attack surfaces, and automate response workflows. This enables security teams to reduce operational complexity while improving cybersecurity program maturity. By combining Rapid7's global cybersecurity innovation with Licencias OnLine's regional expertise and trusted partner network, this new alliance will make it easier for organizations across Latin America to strengthen cyber resilience while enabling partners to see greater success through measurable business outcomes. Rapid7 is excited to begin this next chapter together and look forward to supporting its partners as they help customers build stronger, more resilient security operations across the region. Ready to grow with Rapid7? Discover how Rapid7 and Licencias OnLine are helping partners accelerate cybersecurity maturity across Latin America.