Staff Engineer, Detection and Response

Apollo.io

1d•$225,400 - $281,800

About The Position

The Staff Engineer, Detection and Response will lead detection and response strategy for Apollo’s Security team while delivering the work hands-on. The role builds detection systems, response automations, and investigation tools; leads complex incidents; and sets standards and architecture that enable the team to detect and contain threats reliably. The position owns detection architecture and coverage planning, security observability, and the detection lifecycle, including prioritization, testing, historical replay, attack simulation, and coverage reviews. It also owns incident-response planning and readiness, leads high-severity incidents across cloud, SaaS, and corporate systems, and uses AI-assisted workflows for triage, investigation, and response with appropriate guardrails and human oversight. The role works across Engineering, Infrastructure, IT, Legal, Fraud, and leadership, and mentors engineers while aligning D&R initiatives with Security key results. Apollo describes itself as an AI-native company and expects employees to use AI and automation to improve productivity. The listed salary range is $225,400–$281,800 USD in total cash compensation, inclusive of annual base salary and annual bonus as applicable. Additional benefits may include equity, bonuses or commissions, a 401(k) plan, paid holidays, flex PTO, parental leave, wellbeing benefits, travel coverage, insurance, FSA/HSA, and medical, dental, and vision benefits.

Requirements

At least 8 years of experience in detection and response, detection engineering, security engineering, or incident response.
A track record of leading D&R strategy or multi-quarter initiatives with measurable results.
Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM; Panther is highly valued.
Strong Python, Git, CI/CD, and detection-as-code skills.
Experience leading high-severity incidents in cloud and SaaS environments and improving the incident response process.
Cloud and SaaS expertise, ideally GCP, and familiarity with tools such as Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, and Snowflake.
Sound judgment with incomplete information and the ability to align technical and non-technical leaders without formal authority.

Nice To Haves

Staff-, Lead-, or Principal-level experience at a high-growth cloud or SaaS company.
Production experience with AI-assisted triage, investigation, or response, and a clear view of its limitations.
Public security work such as detection content, open-source tools, talks, or research, or certifications such as GCIA, GCIH, or GCED.

Responsibilities

Own detection and response strategy, shape it into multi-quarter initiatives tied to Security KRs, and report progress and risks to leadership in business terms.
Coordinate with Engineering, Infrastructure, and IT to plan logging, telemetry, and response readiness into their roadmaps.
Set D&R standards for detections and response as code, review practices, playbook quality, and AI-assisted workflows.
Mentor engineers to own detections and lead incidents, and help raise the hiring bar.
Own detection architecture and the multi-quarter coverage plan, including log sources, enrichment, correlation, alert routing, and cost at scale.
Own security observability, including telemetry onboarding, signal quality, threat intelligence inputs, and alert tuning.
Manage the detection lifecycle, including intake and prioritization, unit tests, historical data replay, attack simulation, and reviews of coverage gaps, latency, false positives, and MTTD.
Build MITRE ATT&CK-aligned detections, threat hunts, and automations using Panther and Python via Git and CI/CD.
Own and improve the incident response plan, including severity model, roles, escalation, communications, on-call, and playbooks for top scenarios.
Build incident response readiness through tabletop exercises with Engineering, Legal, Fraud, and leadership, plus response automation and forensic readiness.
Measure incident response quality using MTTA/MTTR by severity, repeat incidents, and action closure, and apply incident lessons to detections, automation, and process.
Lead high-severity incidents as senior technical lead or incident commander across cloud, SaaS, and corporate systems.
Set standards for AI-augmented D&R and use AI and agents for triage, enrichment, investigation, and response with guardrails and human-in-the-loop oversight.
Measure AI-assisted D&R gains in speed, coverage, and signal quality, and help define detection of misuse of Apollo’s AI systems and agent features.