Lead Product Manager, AI-SOC

Rapid7 • Remote - California, CA

2d • $156,200 - $211,400 • Remote

About The Position

Rapid7 is seeking a Lead Product Manager, AI-SOC to define and execute the strategy powering our autonomous investigation platform. This domain-first role owns everything the investigation agent knows and does, translating deep Detection & Response expertise into a high-impact product roadmap.

The AI-SOC product team sits within Rapid7's Detection & Response organization and builds the autonomous investigation platform powering our MDR service. Operating at the intersection of managed security operations and agentic AI, the team develops capabilities that triage alerts at machine speed so analysts can focus on high-value decisions.

As a Lead Product Manager, AI-SOC, your primary responsibility will be to own the content layer that determines what the autonomous agent investigates, how it investigates, and what it concludes. Specifically, your focus will be to:
Define and maintain the full library of investigation playbooks and queries executed across alert types, data sources, and severities, owning the continuous improvement backlog.
Establish telemetry and schema requirements for onboarding new log sources and alert integrations in direct partnership with engineering and data teams.
Own the status disposition logic and suppression framework, guiding the evolution from rule-based heuristics to an advanced ML-driven disposition engine.
Incorporate threat intelligence, including IOC matching, actor context, and TTP enrichment, into autonomous investigation workflows.
Establish and track core quality metrics, including coverage rate, disposition accuracy, and false positive rates, leveraging feedback loops from MDR analysts.
Partner with MDR operations to ensure autonomous investigation output consistently meets the quality bar required to replace manual Tier 1–2 triage at scale.

Requirements

• 7+ years of experience in security operations, alert triage, detection engineering, or security engineering within an MDR, MSSP, or enterprise SOC environment.
• Deep working knowledge of Detection & Response across multiple technical domains, including endpoint, network, identity, cloud, or SaaS/email.
• Direct experience with major EDR/XDR platforms to write queries, review telemetry, and render defensible disposition decisions.
• Strong proficiency in investigation methodology and the MITRE ATT&CK framework to map alert types to adversary behaviors.
• 2+ years in product management or equivalent SOC leadership where domain expertise was translated into clear engineering requirements.
• Drive efficient decision-making that resolves complex product challenges and enables operational momentum across diverse stakeholder groups.
• Establish clear ownership and accountability for delivery outcomes, quality metrics, and operational commitments.
• Build global cross-functional networks across engineering, data science, and security operations to drive sustainable platform enhancements.
• Act as an active driver of change when transitioning legacy operations toward AI-driven autonomous workflows.
• Strong written and verbal communication skills to align cross-functional partners and executive stakeholders around vision and execution.
• US Citizenship with active or prior security clearance experience in federal or government environments.

Responsibilities

• Define and maintain the full library of investigation playbooks and queries executed across alert types, data sources, and severities, owning the continuous improvement backlog.
• Establish telemetry and schema requirements for onboarding new log sources and alert integrations in direct partnership with engineering and data teams.
• Own the status disposition logic and suppression framework, guiding the evolution from rule-based heuristics to an advanced ML-driven disposition engine.
• Incorporate threat intelligence, including IOC matching, actor context, and TTP enrichment, into autonomous investigation workflows.
• Establish and track core quality metrics, including coverage rate, disposition accuracy, and false positive rates, leveraging feedback loops from MDR analysts.
• Partner with MDR operations to ensure autonomous investigation output consistently meets the quality bar required to replace manual Tier 1–2 triage at scale.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed