Staff Engineer, Security Operations

Apollo.io is hiring a Staff Engineer, Security Operations to lead its detection and response strategy while delivering hands-on security systems, automations, and investigation tools. The role owns detection architecture and incident response readiness, leads high-severity incidents, and advances AI-assisted security workflows.

Responsibilities:

• Own D&R strategy and turn it into multi-quarter initiatives tied to Security KRs. Report progress and risks to leadership in business terms
• Work with Engineering, Infrastructure and IT so logging, telemetry and response readiness are planned into their roadmaps early
• Set D&R standards: detections and response as code, review practices, playbook quality, and AI-assisted workflows
• Mentor engineers to own detections and lead incidents, and help raise the hiring bar
• Own detection architecture and the multi-quarter coverage plan: log sources, enrichment, correlation, alert routing, and cost at scale
• Own security observability: telemetry onboarding, signal quality, threat intel inputs and alert tuning
• Run the detection lifecycle: intake and prioritization, unit tests, replay against historical data, attack simulation, and regular reviews of coverage gaps, latency, false positives and MTTD
• Stay hands-on: ship MITRE ATT&CK-aligned detections, threat hunts and automations in Panther and Python via Git and CI/CD
• Own and improve the IR plan: severity model, roles, escalation, communications, on-call and playbooks for our top scenarios
• Build IR readiness: tabletop exercises with Engineering, Legal, Fraud and leadership, plus response automation and forensic readiness
• Measure IR quality (MTTA/MTTR by severity, repeat incidents, action closure) and feed every incident’s lessons back into detections, automation and process
• Lead high-severity incidents as senior technical lead or incident commander across cloud, SaaS and corporate systems

Requirements:

• 8+ years in detection and response, detection engineering, security engineering or incident response
• Track record of leading D&R strategy or multi-quarter initiatives with measurable results
• Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM (Panther highly valued)
• Strong Python, Git, CI/CD and detection-as-code skills
• Experience leading high-severity incidents in cloud and SaaS environments and improving the IR process behind them
• Cloud and SaaS expertise, ideally GCP, plus familiarity with tools like Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji and Snowflake
• Sound judgment with incomplete information, and the influence to align technical and non-technical leaders without formal authority
• Staff, Lead or Principal-level experience at a high-growth cloud or SaaS company
• AI-assisted triage, investigation or response in production, with a clear view of its limits
• Public security work (detection content, open-source tools, talks, research) or certifications such as GCIA, GCIH or GCED