[Remote] Staff Engineer, Security Operations

Note: The job is a remote job and is open to candidates in USA. Apollo.io is hiring a Staff Engineer, Security Operations to lead its detection and response strategy while delivering detection systems, response automations, and investigation tools hands-on. The role also leads complex security incidents and establishes standards, architecture, and AI-augmented workflows for the Security team.

Responsibilities

• Own D&R strategy and turn it into multi-quarter initiatives tied to Security KRs. Report progress and risks to leadership in business terms
• Work with Engineering, Infrastructure and IT so logging, telemetry and response readiness are planned into their roadmaps early
• Set D&R standards: detections and response as code, review practices, playbook quality, and AI-assisted workflows
• Mentor engineers to own detections and lead incidents, and help raise the hiring bar
• Own detection architecture and the multi-quarter coverage plan: log sources, enrichment, correlation, alert routing, and cost at scale
• Own security observability: telemetry onboarding, signal quality, threat intel inputs and alert tuning
• Run the detection lifecycle: intake and prioritization, unit tests, replay against historical data, attack simulation, and regular reviews of coverage gaps, latency, false positives and MTTD
• Stay hands-on: ship MITRE ATT&CK-aligned detections, threat hunts and automations in Panther and Python via Git and CI/CD
• Own and improve the IR plan: severity model, roles, escalation, communications, on-call and playbooks for our top scenarios
• Build IR readiness: tabletop exercises with Engineering, Legal, Fraud and leadership, plus response automation and forensic readiness
• Measure IR quality (MTTA/MTTR by severity, repeat incidents, action closure) and feed every incident’s lessons back into detections, automation and process
• Lead high-severity incidents as senior technical lead or incident commander across cloud, SaaS and corporate systems
• You’ll set the standard for AI-augmented D&R
• You’ll use AI and agents for triage, enrichment, investigation and response, with guardrails and human-in-the-loop where it matters
• You’ll measure the gains in speed, coverage and signal quality
• You’ll also help define how we detect misuse of Apollo’s own AI systems and agent features

Skills

• 8+ years in detection and response, detection engineering, security engineering or incident response
• Track record of leading D&R strategy or multi-quarter initiatives with measurable results
• Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM (Panther highly valued)
• Strong Python, Git, CI/CD and detection-as-code skills
• Experience leading high-severity incidents in cloud and SaaS environments and improving the IR process behind them
• Cloud and SaaS expertise, ideally GCP, plus familiarity with tools like Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji and Snowflake
• Sound judgment with incomplete information, and the influence to align technical and non-technical leaders without formal authority
• Staff, Lead or Principal-level experience at a high-growth cloud or SaaS company
• AI-assisted triage, investigation or response in production, with a clear view of its limits
• Public security work (detection content, open-source tools, talks, research) or certifications such as GCIA, GCIH or GCED

Benefits

• Equity
• Company bonus or sales commissions/bonuses
• 401(k) plan
• At least 10 paid holidays per year
• Flex PTO
• Parental leave
• Employee assistance program and wellbeing benefits
• Global travel coverage
• Life/AD&D/STD/LTD insurance
• FSA/HSA
• Medical, dental, and vision benefits

Company Overview

Company H1B Sponsorship