Detection & Response Analyst

Rapid7 • Arlington, VA

1d

About The Position

Detection & Response Analysts identify, investigate, and respond to security threats across diverse customer environments. They analyze security telemetry across endpoint, identity, cloud, and network vectors to protect global organizations from active cyber threats.

Rapid7’s Managed Detection and Response (MDR) team provides 24/7 security monitoring, threat hunting, and incident investigation for organizations around the world.

As a Detection & Response Analyst, your primary responsibility will be to identify, investigate, and respond to security threats across customer environments. Specifically, your focus will be to:

Conduct investigations into suspicious and malicious activity across endpoint, identity, cloud, and network telemetry within customer environments.
Analyze security alerts and telemetry to identify attacker behavior and impact, following defined escalation paths for potential compromises.
Investigate standard security incidents, including common malware infections, unauthorized access attempts, and credential abuse.
Assist senior analysts and Incident Response Consultants during larger engagements to build exposure to complex threat scenarios.
Document investigation findings clearly in reports, detailing timelines of activity and recommended remediation steps aligned with the MITRE ATT&CK framework.
Collaborate with SOC Advisors to ensure investigation findings and recommended remediation actions are communicated effectively to customers.
Identify and report detection gaps or noisy alerts to help the team refine detection logic.
Maintain high operational standards by meeting service level objectives for alert triage and investigation quality.

Requirements

• 2–4 years of experience in cybersecurity operations, IT security, or a related technical role within a SOC or monitoring environment.
• Foundational understanding of attacker tactics, techniques, and procedures (TTPs), such as persistence, defense evasion, and lateral movement.
• Utilize security tools (SIEM, EDR, or NDR) to triage alerts, analyze telemetry, and assess potential compromise.
• Knowledge of Windows and Linux operating systems, including system logs and processes, to conduct thorough technical investigations.
• Leverage investigative frameworks like MITRE ATT&CK to categorize security events and document timelines of activity.
• Communicate technical findings clearly in written reports and verbal updates to ensure findings are actionable by conveying objectives and rationale to foster commitment.
• Drive efficient decision-making to resolve challenges and enable momentum during active incident triaging.
• Hold self accountable for driving outcomes and meeting operational service level objectives for alert triage.
• Build a network and work across boundaries with senior analysts and advisors to deliver sustainable security improvements.
• Eager interest in understanding why changes occur and act as an active driver in evolving security environments.
• Strong attention to detail and continuous curiosity to adapt and grow in a fast-paced environment.
• Embody our core values to foster a culture of excellence that drives meaningful impact and collective success.

Responsibilities

• Conduct investigations into suspicious and malicious activity across endpoint, identity, cloud, and network telemetry within customer environments.
• Analyze security alerts and telemetry to identify attacker behavior and impact, following defined escalation paths for potential compromises.
• Investigate standard security incidents, including common malware infections, unauthorized access attempts, and credential abuse.
• Assist senior analysts and Incident Response Consultants during larger engagements to build exposure to complex threat scenarios.
• Document investigation findings clearly in reports, detailing timelines of activity and recommended remediation steps aligned with the MITRE ATT&CK framework.
• Collaborate with SOC Advisors to ensure investigation findings and recommended remediation actions are communicated effectively to customers.
• Identify and report detection gaps or noisy alerts to help the team refine detection logic.
• Maintain high operational standards by meeting service level objectives for alert triage and investigation quality.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed