R

Rapid7

Provides cloud-based security analytics and automation

Vice President, Product Management - MDR

Full-TimeUpdated on 10/20/2026
$259.3k - $350.8k/yr+ Variable/incentive compensation + Equity
Expert
California, USA
Remote
ProductProduct Management

About the job

Requirements
  • At least 12 years of product management experience, including significant experience leading products for managed services, SaaS platforms, or security products.
  • A deep understanding of cybersecurity, particularly detection and response, managed detection and response, security operations center operations, or incident response.
  • A proven track record of leading and scaling product teams in a fast-paced, customer-centric environment.
  • Ability to drive a multi-year product vision while staying grounded in near-term execution and time-bound milestones.
  • Ability to establish clear accountability and ownership across teams to deliver value for managed service customers.
  • Ability to make efficient decisions that resolve complex product challenges and maintain operational momentum across functions.
  • Ability to communicate complex product strategies clearly to executive and customer audiences.
  • Ability to build global cross-functional networks across engineering, services, sales, and executive leadership to drive aligned business outcomes.
  • Ability to engage constructively in challenging conversations to find common ground across cross-functional stakeholder groups.
  • Self-awareness to adapt leadership style to varying group dynamics across technical and business teams.
  • Ability to navigate change and drive product evolution in a fast-moving market.
Responsibilities
  • Define and drive the MDR product strategy and roadmap, aligning it with Rapid7's broader detection and response vision.
  • Partner with security operations center leadership to understand analyst workflows, operational pain points, and required platform capabilities.
  • Lead and develop a high-performing team of product managers, fostering accountability and continuous learning.
  • Translate customer insights, market trends, and competitive intelligence into product decisions that drive retention and expansion.
  • Collaborate with engineering to define and deliver a platform roadmap that gives MDR analysts speed, context, and automation.
  • Represent the MDR product as a senior customer-facing voice by engaging with strategic accounts and building trust through transparency.
  • Define and track product objectives and key results and success metrics to improve the service experience and business outcomes.
  • Work cross-functionally with sales, marketing, and customer success to ensure product positioning, launch readiness, and customer adoption.

About the company

R

Rapid7

View
Website

Rapid7 provides cloud-based tools for visibility, analytics, and automation to help security teams protect organizations. Its Insight Cloud collects telemetry from networks and systems to identify vulnerabilities, detect malicious activity, investigate incidents, and automate tasks. The company combines threat analytics, vulnerability management, and security automation in a single platform, sold via subscriptions to enterprises and government agencies worldwide. Unlike some competitors with separate tools, Rapid7 focuses on an integrated cloud-native platform that automates routine security work to improve efficiency and incident response.

Company Size

1,001-5,000

Company Stage

IPO

Headquarters

Boston, Massachusetts

Founded

2000

Get referred to Rapid7

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • Q2 2026 revenue hit $210.9 million, and non-GAAP EPS reached $0.44.
  • Licencias OnLine expands Latin American channel reach across cloud and government buyers.
  • Rapid7 Intelligence launched October 2, 2026, converting vulnerability research into product actions.

What critics are saying

  • ARR fell 2% to $824 million in Q2 2026, signaling demand erosion.
  • Rapid7 cut 314 jobs in 2026; execution risk rises through Q4 integration.
  • Elastic, CrowdStrike, and Palo Alto pressure Rapid7's core platform; share losses can persist.

What makes Rapid7 unique

  • Oct. 2, 2026 Intelligence fuses Labs research, MDR, and Exposure Management into one engine.
  • March 26, 2026 Kenzo acquisition adds agentic AI investigations at machine speed.
  • 11,500 customers worldwide and open-source Metasploit anchor Rapid7's community-led reputation.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Health Insurance
  • Dental Insurance
  • Vision Insurance
  • Unlimited Paid Time Off
  • Flexible Work Hours
  • Remote Work Options
  • Paid Vacation
  • Paid Holidays
  • Sabbatical Leave
  • Company Equity
  • Stock Options
  • 401(k) Retirement Plan

Growth & Insights and Company News

Headcount

6 month growth

0%

1 year growth

0%

2 year growth

0%
SparTech Software
Oct 3rd, 2026
BPFDoor, AVERAT Linux implants stalk telecom edge.

BPFDoor, AVERAT Linux implants stalk telecom edge. Rapid7 Intelligence has disclosed a new modular Linux malware ecosystem that fuses fresh BPFDoor variants, a BPF-based Rekoobe build, and a novel AVERAT implant to compromise telecom and network-edge infrastructure in South Korea and Taiwan.[[1]] [[2]] [[11]] The campaigns concentrate on mail and security appliances at the perimeter, pushing command-and-control over SMTP and blending into legitimate mail flows to stay below the radar of conventional network monitoring.[[1]] [[2]] [[4]] Researchers report that the operators rely on a Linux dropper that writes a shell script to targeted appliances, staging two binaries under innocuous daemon names such as ntpdate and udevds in /sbin before deleting the files while leaving the processes resident in memory.[[1]] One payload re-executes as a watchdog to maintain persistence without an on-disk footprint, while the other carries either an AVERAT implant or a BPFDoor variant customized to the vendor platform and role of the device.[[1]] [[4]] In the South Korean cluster, the dropper derives its encryption key from the string ShareTech and resides in the appliance's add-on package directory, while BPFDoor samples spoof local SpamSniper antispam software by impersonating its PID file and rotating through benign-looking Linux daemon identities.[[1]] [[4]] A parallel cluster targets Taiwanese appliances with six AVERAT builds that adopt process names and configuration paths matching regional telecom and edge vendors, highlighting the operators' detailed knowledge of their victims' software stacks.[[1]] [[2]] Rapid7's reconstruction of the BPFDoor controller source code shows the backdoor evolving from raw Layer 4 "magic bytes" in TCP and UDP headers to HTTP-tunneled triggers wrapped in ordinary-looking HTTPS POST requests traversing edge proxies in telecom environments.[[1]] [[3]] [[15]] Because proxies add and modify HTTP headers such as X-Forwarded-For and alter User-Agent lengths, the controller can no longer rely on fixed byte offsets; instead it sends mathematically padded requests like POST /admin/login.aspx?id=99990 so that the string 9999 consistently lands at a known position, then uses that marker to locate the rnrn separator and extract a hex-encoded command payload from the HTTP body.[[1]] [[3]] The controller's dogetlogin function hard-codes realistic web login paths to blend into logs, while the running process spoofs /usr/sbin/abrtd via Linux prctl calls, applying the disguise only on non-Solaris systems.[[1]] [[15]] Newly documented flags add HTTPS POST tunneling, hidden IP fields, custom URI directories, and verbose debug output on top of older ICMP, UDP, and raw TCP trigger modes, giving operators flexible ways to activate implants and pivot within compromised networks.[[1]] [[3]] On the data plane, one newly observed BPFDoor variant creates a raw PF_PACKET socket and attaches a classic BPF filter that matches specific "magic" byte sequences in UDP, TCP, and ICMP traffic before opening shells or performing UDP knocks, depending on the password embedded in the trigger packet.[[1]] Strings inside the binary are obfuscated with a rotating substitution alphabet, but once decoded they reveal explicit product spoofing artifacts and a suite of process-name disguises that mimic common Linux daemons such as chronyd, rsyslogd, crond, and NetworkManager, alongside mutex references to /var/run/spamsniper.pid that tie the build to SpamSniper-protected mail and telecom environments in South Korea.[[1]] [[4]] A separate sample gates on a unique 14-byte payload via a 16-instruction BPF program and spoofs its identity as ora_ppmond, echoing Oracle-backed HSS and OSS/BSS platforms used by telecom providers so that the implant looks legitimate only on hosts actually running that class of infrastructure.[[1]] [[2]] Elsewhere, BPFDoor activity has been linked to the China-nexus group sometimes described as Red Menshen, but Rapid7 has not publicly pinned this latest SMTP-focused edge campaign to a specific threat actor.[[7]] [[8]] [[15]] The AVERAT implants themselves are described as modular Linux remote access tools that favor SMTP over port 25 for command-and-control, allowing attackers to hide lateral movement and exfiltration inside the same mail security traffic defenders expect to see near the network core.[[1]] [[2]] [[4]] According to independent reporting, these operations also abuse compromised consumer and small-business appliances - including NAS devices, DVRs, and broadband gateways - as relays and persistence nodes, extending the reach of the ecosystem beyond traditional carrier gear into adjacent infrastructure.[[2]] [[11]] That mix of fileless execution, vendor-specific process spoofing, passive BPF listeners, and mail-based C2 means conventional port-centric monitoring and simple process name checks are unlikely to surface the implants without more targeted hunting.[[1]] [[3]] [[9]] Rapid7 and other security firms have released BPFDoor detection scripts and guidance that focus on kernel-level BPF hooks, suspicious raw socket usage, anomalous process-command-line combinations, and unusual DNS, ICMP, or SMTP patterns, and telecom operators are being urged to apply those tools across edge proxies, mail gateways, and embedded devices as part of focused threat hunting and incident response.[[3]] [[9]] [[12]] Compare Security

Associated Press
Oct 2nd, 2026
Rapid7 launches Intelligence platform to transform threat defenses from reactive to proactive

Rapid7 has launched Rapid7 Intelligence, a unified engine designed to transform enterprise threat defenses from reactive monitoring to proactive prevention. The platform combines threat intelligence, vulnerability research, and the legacy of Rapid7 Labs to turn insights on attacker behaviour into AI-powered action. The company tracked 8,539 critical vulnerabilities in Q2 alone. Rapid7 Intelligence monitors threats in real time to deliver actionable, expert-validated insights. Rapid7 researchers recently uncovered a modular Linux malware ecosystem targeting telecom and network-edge devices. The discovery demonstrates the platform's ability to analyse shared behaviours and uncover emerging attack patterns. The intelligence flows directly into Rapid7 products, MDR, and Exposure Management to neutralise adversary infrastructure before attacks execute. Rapid7 serves more than 11,500 customers worldwide.

TMCnet
Oct 2nd, 2026
Rapid7 Launches Rapid7 Intelligence to Harness Threat Data Against Attackers

Rapid7 Launches Rapid7 Intelligence to Harness Threat Data Against Attackers TMCnet News [October 02, 2026] | / | Rapid7 Launches Rapid7 Intelligence to Harness Threat Data Against Attackers BOSTON, Oct. 02, 2026 (GLOBE NEWSWIRE) - Today, Rapid7, Inc. (NASDAQ: RPD), a global leader in AI-powered managed cybersecurity operations, announced the launch of Rapid7 Intelligence, a unified engine designed to transform enterprise threat defenses from reactive monitoring to proactive prevention. By combining threat intelligence, vulnerability research, and the legacy of Rapid7 Labs, Rapid7 Intelligence transforms insights on attacker behavior into AI-powered action to help organizations anticipate and disrupt attacks. Indicators Expire. Behavior Doesn't: Defense for the Agentic Era. Building on Rapid7 Labs' 13-year legacy, Rapid7 Intelligence turns attacker behavior into scalable protection faster than traditional vendors reliant on static indicators. With AI compressing exploitation windows to minutes - and 8,539 critical vulnerabilities tracked in Q2 alone - attackers are leveraging automation to scale phishing, reconnaissance, and script development. Rapid7 Intelligence monitors these threats in real time to deliver actionable, expert-validated insights that keep defenders ahead. "Static threat intelligence isn't completely dead - it's just sitting in standard dashboards doing what it's always done, giving organizations a false sense of security while autonomous threat agents burn down their perimeters," said Christiaan Beek, Vice President of Rapid7 Intelligence. "The real differentiator isn't hoarding more raw feeds; it's having curated, vetted intelligence focused relentlessly on true signals rather than waiting around for alerts to trigger after the damage is done. Rapid7 Intelligence isn't built to generate another 50-page PDF report for security teams to ignore; it aggressively converts real-time operational adversary insight into a proactive, preemptive shield." Rapid7 Intelligence in Action: Behavioral Correlation Exposes a Hidden Linux Malware Ecosystem A concrete illustration of Rapid7 Intelligence's power is a new finding from Rapid7 researchers, who uncovered a modular Linux malware ecosystem - spanning new BPFDoor variants, BPF Rekoobe, droppers, and AVERAT implants - actively targeting telecom and network-edge devices. Researchers identified two campaigns linked by a common focus on the network edge. Rapid7 Intelligence analyzed their shared behaviors, uncovering an emerging pattern: using SMTP to blend into the victim's DMZ, target mail security appliances, and maintain long-term access. New BPFDoor variants indicate the malware family is evolving into an ecosystem where each sample is tailored to the telco plane (control, management, and data plane) it targets, and where threat actors know exactly what software is adopted at each layer. Rapid7 Intelligence will continue tracking and disrupting tactics like this to keep defenders ahead of attackers. Expert-Led, Actionable Intelligence To continuously power research like this and help defenders stay ahead of emerging threats, Rapid7 Intelligence delivers: * Immediate Protective Force: Frontline intelligence bypasses legacy research lags, flowing directly into Rapid7 products, MDR, and Exposure Management to neutralize adversary infrastructure before attacks execute. * Unified Intelligence Engine: Threat intelligence, vulnerability analysis, and engineering inside the products customers already run, instead of a report they have to translate into action themselves. * Uncompromised Community Arsenal: Building on the legendary foundation of Metasploit and Rapid7 Labs, critical advisories, vulnerability research and exploitation insights remain open, ensuring the industry stays capable of pushing back. "In a world of infinite telemetry and automated attacks, playing defense with traditional tools is an exercise in futility," said Mel Stone, Chief Global Services Officer at Rapid7. "Rapid7 Intelligence shifts the balance of power. By fusing machine-scale observation with frontline human expertise, we turn raw threat data into immediate, actionable intelligence - empowering security teams to disrupt adversaries before they establish a foothold." To learn more about Rapid7 Intelligence, visit here. About Rapid7 Rapid7, Inc. (NASDAQ: RPD) is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers. As a recognized leader in preemptive managed detection and response (MDR), Rapid7 unifies exposure and detection to transform the cybersecurity operations of more than 11,500 customers worldwide. For more information, visit its website, check out its blog, or follow Fog Computing World on LinkedIn or X. Media Contact Christine Nurnberger SVP Global Marketing and Growth [email protected] Rapid7 Investor Contact Christopher Keenan Vice President, Deputy General Counsel [email protected] [ Back To TMCnet.com's Homepage] |

Rapid7
Sep 23rd, 2026
How dynamic application security testing validates risk at runtime.

How dynamic application security testing validates risk at runtime. Security teams already have long queues of potential application vulnerabilities. The useful question is what happens next: can they see how a weakness behaves in a running application, reproduce the attack, and give developers enough evidence to fix it? Dynamic application security testing (DAST) helps answer those questions by testing applications as an attacker encounters them. The IDC MarketScape: Worldwide Dynamic Application Security Testing 2026 Vendor Assessment (Doc #US54119126, September 2026). The IDC MarketScape evaluated 16 vendors and named Rapid7 a Leader. Rapid7 believe the result reflects the strength of Rapid7's DAST capabilities, but the IDC MarketScape also offers a useful view of where the category is heading. DAST has developed beyond traditional web scanning into a source of runtime evidence that can help organizations validate risk across the application layer. From possible weakness to validated application risk. Code analysis and dependency scanning help teams identify weaknesses before an application is deployed. DAST provides a different view by interacting with the assembled application while it is running. It can show what happens when a particular request reaches the application, how the application responds, and whether a suspected weakness can be reproduced. This is especially valuable for APIs and AI-backed applications, where risk may emerge through interactions among models, prompts, data, tools, and permissions. Some of these behaviors cannot be fully understood from source code or a dependency manifest. They become visible when the application is exercised under runtime conditions. DAST therefore has a direct role in continuous threat exposure management (CTEM). Discovery gives teams a view of their assets and possible weaknesses, but that view alone does not tell them where to focus. Validation helps narrow the field by showing which exposures can be reached or exploited and providing evidence that teams can use to take action. For Rapid7, DAST is exposure management applied to the application layer. Web applications, APIs, and AI-backed endpoints are all part of the attack surface, so they need to be discovered, tested, prioritized, and managed alongside infrastructure, cloud, and other exposures. Why Rapid7 believe Rapid7 was named a Leader by IDC. Rapid7's DAST solution is delivered as part of the Exposure Command portfolio. Its scan engine maps an application, executes attacks against the discovered paths, and validates confirmed findings. Security teams can map a broad area of an application while limiting active attacks to an appropriate set of paths, giving them control over how testing is performed. Findings are checked against Rapid7 telemetry to help determine which issues warrant closer attention. When a finding needs action, browser-based replay reproduces the original request, the attack request, and the triggering response. Developers receive evidence they can work with, rather than a finding they must first spend time proving. Authenticated scanning can be difficult to maintain across a changing application portfolio, and a broken login sequence can leave important areas untested. Rapid7's solution can identify the affected step and support a targeted update without requiring the entire sequence to be recorded again. The connection with Surface Command adds another useful layer. Newly discovered external assets can be surfaced for application testing, helping teams close the gap between finding an application and understanding the risk it presents DAST plays a core role within Exposure Command: providing the application-layer validation teams need to prioritize risk and move from findings to remediation.

Rapid7
Aug 19th, 2026
Rapid7 and Licencias OnLine partner to accelerate cybersecurity maturity across Latin America.

Rapid7 and Licencias OnLine partner to accelerate cybersecurity maturity across Latin America. Cássio De Alcântara is Director, LATAM Sales at Rapid7. Across Latin America, organizations are embracing cloud, AI, and digital transformation to drive innovation and business growth. These technologies create new opportunities, but also introduce greater complexity and expanding attack surfaces. In this environment, security leaders are being asked to understand where risk exists across increasingly distributed environments and quickly eliminate blind spots like Shadow IT and Shadow AI - all without adding operational complexity. To help security leaders and practitioners address this complexity, Rapid7 is excited to announce a new strategic distribution partnership with Licencias OnLine (LOL) across Latin America. Helping organizations stay ahead of evolving threats. In order to keep day-to-day business operations moving, organizations need security solutions that not only protect critical assets but also support innovation, regulatory compliance, and long-term digital transformation. Rapid7's AI-powered cybersecurity operations platform helps organizations strengthen cyber resilience by unifying continuous exposure management, AI-driven threat detection and response, and security automation. By connecting security data across endpoint, cloud, identity, and infrastructure environments, organizations leverage one platform to gain the visibility to reduce risk and act with confidence. A shared commitment to partner success. Success in today's fragmented cybersecurity environments depends on a strong ecosystem of partners who can help organizations implement, optimize, and maximize the value of unified security operations. This is where Licencias OnLine comes in. With a strong, well-established presence across Latin America, deep cybersecurity expertise, and a highly specialized channel ecosystem, Licencias OnLine brings the local knowledge, technical enablement, and operational agility needed to help partners grow their cybersecurity practices and deliver greater value to customers. Together, Rapid7 and Licencias OnLine will invest in technical training, partner enablement, joint marketing initiatives, and go-to-market programs that help partners expand managed security services, strengthen customer relationships, and accelerate business growth across the region. Building cyber resilience together. As organizations across Latin America continue to modernize their IT environments, they should have access to security operations that are integrated, intelligent, and designed for today's AI-powered threat landscape. Rapid7's open platform supports this approach through hundreds of technology integrations that help organizations eliminate security silos, improve visibility across their attack surfaces, and automate response workflows. This enables security teams to reduce operational complexity while improving cybersecurity program maturity. By combining Rapid7's global cybersecurity innovation with Licencias OnLine's regional expertise and trusted partner network, this new alliance will make it easier for organizations across Latin America to strengthen cyber resilience while enabling partners to see greater success through measurable business outcomes. Rapid7 is excited to begin this next chapter together and look forward to supporting its partners as they help customers build stronger, more resilient security operations across the region. Ready to grow with Rapid7? Discover how Rapid7 and Licencias OnLine are helping partners accelerate cybersecurity maturity across Latin America.