Staff Engineer, Security Operations

Apollo.io

1d•$225,400 - $388,900

About The Position

Apollo.io is hiring a Staff Engineer, Security Operations to lead the Security team’s detection and response (D&R) strategy while delivering hands-on systems, automations, and investigation tools. The role establishes standards and architecture that enable the team to identify and contain threats reliably without dependence on any one person. The position owns D&R strategy and detection architecture, including security observability, telemetry onboarding, signal quality, threat intelligence inputs, alert tuning, and a multi-quarter coverage plan. The engineer builds and maintains MITRE ATT&CK-aligned detections, threat hunts, and automations using Panther and Python, and manages the detection lifecycle through prioritization, testing, historical replay, attack simulation, and coverage reviews. The role also owns and improves incident response planning and readiness, including severity models, escalation, communications, on-call processes, playbooks, tabletop exercises, automation, and forensic readiness. It leads high-severity incidents across cloud, SaaS, and corporate systems, measures response quality, and feeds incident lessons into detection and response improvements. As an AI-native role, this engineer sets standards for AI-augmented detection and response, using AI and agents for triage, enrichment, investigation, and response with appropriate guardrails and human oversight. The role also helps define ways to detect misuse of Apollo’s AI systems and agent features. Success includes a D&R strategy tied to Security KRs, improved detection coverage and precision, tested incident response with faster MTTD/MTTR and fewer repeat incidents, and measurable reductions in manual toil through AI-assisted workflows.

Requirements

At least 8 years of experience in detection and response, detection engineering, security engineering, or incident response.
Track record of leading D&R strategy or multi-quarter initiatives with measurable results.
Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM; Panther is highly valued.
Strong Python, Git, CI/CD, and detection-as-code skills.
Experience leading high-severity incidents in cloud and SaaS environments and improving the incident response process.
Cloud and SaaS expertise, ideally GCP.
Familiarity with tools such as Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, and Snowflake.
Sound judgment with incomplete information and ability to align technical and non-technical leaders without formal authority.

Nice To Haves

Staff-, Lead-, or Principal-level experience at a high-growth cloud or SaaS company.
Production experience with AI-assisted triage, investigation, or response, and a clear understanding of its limits.
Public security work such as detection content, open-source tools, talks, or research, or certifications such as GCIA, GCIH, or GCED.

Responsibilities

Own D&R strategy and translate it into multi-quarter initiatives tied to Security KRs; report progress and risks to leadership in business terms.
Coordinate with Engineering, Infrastructure, and IT to incorporate logging, telemetry, and response readiness into their roadmaps.
Set D&R standards for detections and response as code, review practices, playbook quality, and AI-assisted workflows.
Mentor engineers to own detections and lead incidents, and help raise the hiring bar.
Own detection architecture and the multi-quarter coverage plan, including log sources, enrichment, correlation, alert routing, and cost at scale.
Own security observability, including telemetry onboarding, signal quality, threat intelligence inputs, and alert tuning.
Manage the detection lifecycle, including intake and prioritization, unit tests, historical data replay, attack simulation, and reviews of coverage gaps, latency, false positives, and MTTD.
Build MITRE ATT&CK-aligned detections, threat hunts, and automations in Panther and Python using Git and CI/CD.
Own and improve the incident response plan, including severity model, roles, escalation, communications, on-call, and playbooks for key scenarios.
Build incident response readiness through tabletop exercises with Engineering, Legal, Fraud, and leadership, as well as response automation and forensic readiness.
Measure incident response quality using MTTA/MTTR by severity, repeat incidents, and action closure; apply incident lessons to detections, automation, and process.
Lead high-severity incidents as senior technical lead or incident commander across cloud, SaaS, and corporate systems.
Set standards for AI-augmented detection and response; use AI and agents for triage, enrichment, investigation, and response with guardrails and human oversight.
Measure AI-assisted D&R gains in speed, coverage, and signal quality, and help define methods to detect misuse of Apollo’s AI systems and agent features.