Staff Engineer, Apollo.io

• 8+ years in detection and response, detection engineering, security engineering or incident response
• Track record of leading D&R strategy or multi-quarter initiatives with measurable results
• Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM (Panther highly valued)
• Strong Python, Git, CI/CD and detection-as-code skills
• Experience leading high-severity incidents in cloud and SaaS environments and improving the IR process behind them
• Cloud and SaaS expertise, ideally GCP, plus familiarity with tools like Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji and Snowflake
• Sound judgment with incomplete information, and the influence to align technical and non-technical leaders without formal authority

Desirable

• You’ll lead detection and response (D&R) strategy for Apollo’s Security team, and you’ll deliver it hands-on
• You’ll build detection systems, response automations and investigation tools in weeks, not months
• You’ll lead our most complex incidents
• You’ll also set the standards and architecture that let the team catch and contain real threats without depending on any one person
• Own D&R strategy and turn it into multi-quarter initiatives tied to Security KRs. Report progress and risks to leadership in business terms
• Work with Engineering, Infrastructure and IT so logging, telemetry and response readiness are planned into their roadmaps early
• Set D&R standards: detections and response as code, review practices, playbook quality, and AI-assisted workflows
• Mentor engineers to own detections and lead incidents, and help raise the hiring bar
• Own detection architecture and the multi-quarter coverage plan: log sources, enrichment, correlation, alert routing, and cost at scale
• Own security observability: telemetry onboarding, signal quality, threat intel inputs and alert tuning
• Run the detection lifecycle: intake and prioritization, unit tests, replay against historical data, attack simulation, and regular reviews of coverage gaps, latency, false positives and MTTD
• Stay hands-on: ship MITRE ATT&CK-aligned detections, threat hunts and automations in Panther and Python via Git and CI/CD
• Own and improve the IR plan: severity model, roles, escalation, communications, on-call and playbooks for our top scenarios
• Build IR readiness: tabletop exercises with Engineering, Legal, Fraud and leadership, plus response automation and forensic readiness
• Measure IR quality (MTTA/MTTR by severity, repeat incidents, action closure) and feed every incident’s lessons back into detections, automation and process
• Lead high-severity incidents as senior technical lead or incident commander across cloud, SaaS and corporate systems
• You’ll set the standard for AI-augmented D&R
• You’ll use AI and agents for triage, enrichment, investigation and response, with guardrails and human-in-the-loop where it matters
• You’ll measure the gains in speed, coverage and signal quality
• You’ll also help define how we detect misuse of Apollo’s own AI systems and agent features
• How success is measured
• A D&R strategy tied to Security KRs, with telemetry work committed in other teams’ roadmaps
• Better detection coverage and precision for top threats, and a tested IR process with faster MTTD/MTTR and fewer repeat incidents
• AI-assisted triage and response in production, with a measurable drop in manual toil