Staff Engineer, Apollo.io

• 5+ years in Security Detection & Response, Security Engineering, or Incident Response—hands-on experience building and shipping detection systems, not just managing incidents
• 2+ years of people management, including hiring, coaching, and performance management, ideally in a remote-first environment
• Strong technical foundation: modern SIEM platforms, detection engineering, log analysis, threat intelligence workflows. Panther experience highly valued
• Python proficiency for automation, analysis, and internal tooling. You need to remain technically credible with your engineers and review code
• Comfort with startup velocity: able to make sound decisions with incomplete information, ship fast, iterate based on feedback, and know when "good enough" is good enough
• Git workflows, CI/CD practices, and experience building security content and automation pipelines as code
• Cloud-native and SaaS expertise: GCP preferred. Familiarity with Apollo's toolsets (Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, Panther, Snowflake) strongly valued
• Excellent communication: You'll translate technical security work into business impact for executives and explain engineering trade-offs to non-technical stakeholders

Desirable

• Apollo is looking for a startup-minded Staff Engineer to lead our Security Detection & Response team. You'll build and scale a team that ships detection systems, automations, and investigation tools at startup velocity—moving from concept to production in weeks, not months
• This is a hands-on leadership role for someone who can coach engineers, make fast decisions with incomplete information, and stay close to the technical details while balancing speed with rigor
• This role operates in a fully remote environment and requires excellent asynchronous communication, comfort with ambiguity, and the ability to ship fast and learn from what sticks
• Build, lead, and retain a high-performing remote Security Detection & Response team with clear expectations, strong onboarding, documentation, and knowledge-sharing practices
• Coach engineers to grow in technical depth, operational ownership, and leadership capability while prioritizing shipping velocity and iteration over perfection
• Define team culture around experimentation: ship detection rules quickly, measure effectiveness, iterate based on signal
• Partner closely with Engineering, Infrastructure, IT, Fraud, Legal, People, Support, and Product—translating security risk into business decisions and communicating impact clearly to both technical and non-technical stakeholders
• Define and evolve the Security Detection & Response strategy: what to build, when, and why. Prioritize ruthlessly; not every threat gets a detection
• Lead the team in shipping detection rules, MITRE ATT&CK-aligned use cases, investigation playbooks, and response automations with measurement and validation loops—but ship first, perfect later
• Oversee Panther detections and AI-assisted workflows for triage, enrichment, and response. Continuously measure coverage, precision, latency, and tuning effectiveness through safe rollout and attack simulation
• Drive Python-based tooling, Git-based workflows, and CI/CD practices to enable the team to ship detection content in days, not quarters
• Stay close to the technical work: code reviews, architecture decisions, and hands-on problem-solving alongside the team
• Own end-to-end security observability: telemetry onboarding, signal quality, threat intelligence inputs, and alert tuning. Good detections prevent incidents
• Lead complex and high-severity incidents with clear decision-making and effective communication. Translate incident learnings into detection and response priorities for the next sprint
• Stay technically engaged in investigations across cloud infrastructure, SaaS platforms, corporate systems, and user behavior. Use incidents as teaching moments for the team and validation for detection strategy
• Work with Engineering and Infrastructure on telemetry pipelines and operational readiness. Ensure the team has the data they need to ship fast
• Define and own strategy-aligned metrics: detection latency, coverage gaps, false positive rates, team velocity. Use data to inform priorities and stakeholder decisions
• Communicate security impact in business terms: what risks are you preventing, and what's the cost of being wrong?