Detection & Response Analyst

Detection & Response Analysts identify, investigate, and respond to security threats across diverse customer environments. They analyze security telemetry across endpoint, identity, cloud, and network vectors to protect global organizations from active cyber threats.
About the Team
Rapid7's Managed Detection and Response (MDR) team provides 24/7 security monitoring, threat hunting, and incident investigation for organizations around the world.
About the Role
As a Detection & Response Analyst, your primary responsibility will be to identify, investigate, and respond to security threats across customer environments. Specifically, your focus will be to:

• Conduct investigations into suspicious and malicious activity across endpoint, identity, cloud, and network telemetry within customer environments.
• Analyze security alerts and telemetry to identify attacker behavior and impact, following defined escalation paths for potential compromises.
• Investigate standard security incidents, including common malware infections, unauthorized access attempts, and credential abuse.
• Assist senior analysts and Incident Response Consultants during larger engagements to build exposure to complex threat scenarios.
• Document investigation findings clearly in reports, detailing timelines of activity and recommended remediation steps aligned with the MITRE ATT&CK framework.
• Collaborate with SOC Advisors to ensure investigation findings and recommended remediation actions are communicated effectively to customers.
• Identify and report detection gaps or noisy alerts to help the team refine detection logic.
• Maintain high operational standards by meeting service level objectives for alert triage and investigation quality.

The skills and qualities you'll bring include

• Bring 2-4 years of experience in cybersecurity operations, IT security, or a related technical role within a SOC or monitoring environment.
• Demonstrate a foundational understanding of attacker tactics, techniques, and procedures (TTPs), such as persistence, defense evasion, and lateral movement.
• Utilize security tools (SIEM, EDR, or NDR) to triage alerts, analyze telemetry, and assess potential compromise.
• Apply knowledge of Windows and Linux operating systems, including system logs and processes, to conduct thorough technical investigations.
• Leverage investigative frameworks like MITRE ATT&CK to categorize security events and document timelines of activity.
• Communicate technical findings clearly in written reports and verbal updates to ensure findings are actionable by conveying objectives and rationale to foster commitment.
• Drive efficient decision-making to resolve challenges and enable momentum during active incident triaging.
• Hold self accountable for driving outcomes and meeting operational service level objectives for alert triage.
• Build a network and work across boundaries with senior analysts and advisors to deliver sustainable security improvements.
• Demonstrate eager interest in understanding why changes occur and act as an active driver in evolving security environments.
• Express strong attention to detail and continuous curiosity to adapt and grow in a fast-paced environment.
• Embody our core values to foster a culture of excellence that drives meaningful impact and collective success.

We know that the best ideas and solutions come from multi-dimensional teams. That's because these teams reflect a variety of backgrounds and professional experiences. If you are excited about this role and feel your experience can make an impact, please don't be shy - apply today.
#LI-TD1
About Rapid7
At Rapid7, our vision is to create a secure digital world for our customers, our industry, and our communities. We do this by harnessing our collective expertise and passion to challenge what's possible and drive extraordinary impact. We're building a dynamic and collaborative workplace where new ideas are welcome.
Protecting 11,500+ customers against bad actors and threats means we're continuing to push the envelope just like we' ve been doing for the past 20 years. If you 're ready to solve some of the toughest challenges in cybersecurity, we're ready to help you take command of your career. Join us.
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status or any other status protected by applicable national, federal, state or local law.