Lead Product Manager, AI-SOC

Role Description

Rapid7 is seeking a Lead Product Manager, AI-SOC to define and execute the strategy powering our autonomous investigation platform. This domain-first role owns everything the investigation agent knows and does, translating deep Detection & Response expertise into a high-impact product roadmap.

As a Lead Product Manager, AI-SOC, your primary responsibility will be to own the content layer that determines what the autonomous agent investigates, how it investigates, and what it concludes. Specifically, your focus will be to:

• Define and maintain the full library of investigation playbooks and queries executed across alert types, data sources, and severities, owning the continuous improvement backlog.
• Establish telemetry and schema requirements for onboarding new log sources and alert integrations in direct partnership with engineering and data teams.
• Own the status disposition logic and suppression framework, guiding the evolution from rule-based heuristics to an advanced ML-driven disposition engine.
• Incorporate threat intelligence, including IOC matching, actor context, and TTP enrichment, into autonomous investigation workflows.
• Establish and track core quality metrics, including coverage rate, disposition accuracy, and false positive rates, leveraging feedback loops from MDR analysts.
• Partner with MDR operations to ensure autonomous investigation output consistently meets the quality bar required to replace manual Tier 1–2 triage at scale.

Qualifications

• 7+ years of experience in security operations, alert triage, detection engineering, or security engineering within an MDR, MSSP, or enterprise SOC environment.
• Deep working knowledge of Detection & Response across multiple technical domains, including endpoint, network, identity, cloud, or SaaS/email.
• Direct experience with major EDR/XDR platforms to write queries, review telemetry, and render defensible disposition decisions.
• Strong proficiency in investigation methodology and the MITRE ATT&CK framework to map alert types to adversary behaviors.
• 2+ years in product management or equivalent SOC leadership where domain expertise was translated into clear engineering requirements.
• Efficient decision-making that resolves complex product challenges and enables operational momentum across diverse stakeholder groups.
• Clear ownership and accountability for delivery outcomes, quality metrics, and operational commitments.
• Global cross-functional networks across engineering, data science, and security operations to drive sustainable platform enhancements.
• Active driver of change when transitioning legacy operations toward AI-driven autonomous workflows.
• Strong written and verbal communication skills to align cross-functional partners and executive stakeholders around vision and execution.
• US Citizenship with active or prior security clearance experience in federal or government environments.
• Embody core values to foster a culture of excellence that drives meaningful impact and collective success.

Benefits

• Annual salary range for this role, depending on location, is: United States: $156,200.00 - 211,400.00 USD Annual.
• Salary ranges may vary based on geographical location. This range does not include variable/incentive compensation, equity, and benefits (where applicable/eligible).

Company Description

At Rapid7, our vision is to create a secure digital world for our customers, our industry, and our communities. We do this by harnessing our collective expertise and passion to challenge what’s possible and drive extraordinary impact. We’re building a dynamic and collaborative workplace where new ideas are welcome.

• Protecting 11,500+ customers against bad actors and threats means we’re continuing to push the envelope just like we’ve been doing for the past 20 years.
• If you’re ready to solve some of the toughest challenges in cybersecurity, we’re ready to help you take command of your career.