The Metasploit R+D team is responsible for growing the module repository that makes Metasploit Framework the world’s most popular exploitation framework, and for producing research on offensive techniques and trends that keep pushing the security ecosystem forward. Earlier this year, we released MSF 5 after a long pause between major versions. Now, we’re thinking about the content and capabilities offensive practitioners need in MSF 6—from new exploits and innovative payloads to more intuitive targeting and stealthier movement within modern environments. 

Want to help us get there? We’re hiring a security researcher to develop high-quality modules and produce research that continues to inspire contributions and interest from a growing community. 

This role is based in Rapid7’s Austin, TX office. Local applicants are strongly preferred; remote applicants may be considered based on experience and team fit. Seniority level is also flexible depending on experience and team fit.

Metasploit Team Opportunities

Help Rapid7 and the Metasploit community work together toward a shared vision for the future of Metasploit Framework and its ecosystem. You will work with a talented global team to develop and maintain new modules and payloads for Framework, produce research on trends that pique interest from both offensive and defensive practitioners, and make substantial technical contributions as a key member of a cross-functional team. You will have the opportunity to diagnose and understand user needs directly. The community is your customer!

Desired Technical Skills

As a Metasploit researcher you’ll need to balance module development and security research and understand how each enhances the other. A good mix of skills includes:

• Knowledge of Metasploit Framework. You understand what it's for and how to use it, and you have opinions on how to develop module content that makes it better. Strong opinions loosely-held are some of our favorites.

• Experience writing standalone PoCs or Metasploit modules. Experience in penetration testing, red teaming, mobile security, or security research is a plus, as is familiarity with the tooling and techniques used to advance these disciplines.

• Experience with Ruby, Python, or Go is a major plus; while Ruby is not necessarily important as your primary language, it is important to be able to understand and extend the techniques that Metasploit embodies. 

• Conversant in distributed and open-source project development. You can review, merge, and rebase with aplomb.

• Interest in vuln analysis, fuzzing, reverse engineering, and/or advanced exploitation techniques; familiarity with tools such as WinDBG, OllyDBG, GDB, IDA Pro, Burp Suite, etc.

• Understanding of modern security mitigations and how to bypass them (e.g., stack cookies, SafeSEH, DEP, ASLR, CFG, and so on)

Soft Skills (just as important as technical skills)

• Interest in hacking and hacker culture, genuine curiosity about how things work, and willingness to figure stuff out.

• Ability to learn and dig into code. Metasploit Framework is comprised of more than a million lines of code contributed by hundreds of developers. Not everything is spelled out, but everything is discoverable. 

• Ability to learn and evaluate new technologies quickly. You’re comfortable with and excited about experimentation and uncertainty. The R+D team encounters and analyzes lots of artifacts and oddities on a regular basis: CVEs, PoC, vulnerable applications, vendor patches, blogs, pastes, Twitter threads, stack traces, error messages, you name it. You’ll bring and hone an instinct for when something belongs in Framework, how to best incorporate it (e.g., module, library, integration?), and what strikes a balance between “intuitive for users” and “maintainable for developers.”

• Ability to work asynchronously and directly with a team of co-workers and volunteers from around the globe.

Ideally, you have a body of work you can point to that showcases your research and development interests. Have you published blogs or technical analysis of vulnerabilities, exploits, or techniques that interest you? Written purpose-built tools that made your life easier? Contributed to open-source projects? Show us what you're passionate about, where your curiosity lies, and how you've tried to pull things together to solve problems for yourself and others.