6 hours ago
Responsibilities
- Own detection and response strategy and translate it into multi-quarter initiatives tied to Security KRs.
- Partner with Engineering, Infrastructure, and IT to incorporate logging, telemetry, and response readiness into roadmaps.
- Define detection and response standards, including detection-as-code, review practices, playbook quality, and AI-assisted workflows.
- Design detection architecture and security observability, including log sources, enrichment, correlation, alert routing, telemetry onboarding, threat intelligence, and alert tuning.
- Build MITRE ATT&CK-aligned detections, threat hunts, response automations, and investigation tools using Panther and Python.
- Run the detection lifecycle through prioritization, unit testing, historical replay, attack simulation, coverage reviews, and false-positive and latency analysis.
- Own and improve the incident response plan, severity model, escalation procedures, communications, on-call practices, and playbooks.
- Lead high-severity incidents as senior technical lead or incident commander across cloud, SaaS, and corporate systems.
- Conduct tabletop exercises and improve forensic readiness, response automation, MTTA, MTTR, and repeat-incident outcomes.
- Mentor engineers, raise the hiring bar, and use AI and agents for security triage, enrichment, investigation, and response.
Requirements
- 8+ years of experience in detection and response, detection engineering, security engineering, or incident response.
- Track record leading detection and response strategy or multi-quarter initiatives with measurable results.
- Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM; Panther is highly valued.
- Strong Python, Git, CI/CD, and detection-as-code skills.
- Experience leading high-severity incidents in cloud and SaaS environments and improving incident response processes.
- Cloud and SaaS expertise, ideally with GCP, plus familiarity with Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, and Snowflake.
- Ability to exercise sound judgment with incomplete information and influence technical and non-technical leaders without formal authority.
- Staff-, Lead-, or Principal-level experience at a high-growth cloud or SaaS company is preferred.
- Production experience with AI-assisted triage, investigation, or response is preferred.
- Public security work or certifications such as GCIA, GCIH, or GCED is preferred.
Benefits
- Equity, company bonus, 401(k), at least 10 paid holidays, flex PTO, parental leave, employee assistance and wellbeing benefits, global travel coverage, insurance, and FSA/HSA and medical, dental, and vision benefits.
- The posting lists pay ranges by US location and states that the range includes total cash compensation.
- Applicants outside the US may request the annual salary range for their location during the interview process.
Tech Stack
Categories
About Apollo.io
Apollo.io builds a go-to-market platform that pairs a large B2B contact database with sales engagement, enrichment, and sequencing tools for revenue teams. Offered as a SaaS subscription, it serves sales and marketing organizations that need prospect data and outbound automation; the company is privately held, founded in 2015, headquartered in San Francisco, and raised a Series D funding round in 2023.