Staff Engineer, Detection and Response

You'll lead detection and response (D&R) strategy for Apollo's Security team, and you'll deliver it hands-on. You'll build detection systems, response automations and investigation tools in weeks, not months. You'll lead our most complex incidents. You'll also set the standards and architecture that let the team catch and contain real threats without depending on any one person.

Responsibilities

Own D&R strategy and turn it into multi-quarter initiatives tied to Security KRs; Work with Engineering, Infrastructure and IT so logging, telemetry and response readiness are planned into their roadmaps early; Set D&R standards: detections and response as code, review practices, playbook quality, and AI-assisted workflows; Mentor engineers to own detections and lead incidents, and help raise the hiring bar; Own detection architecture and the multi-quarter coverage plan; Own security observability: telemetry onboarding, signal quality, threat intel inputs and alert tuning; Run the detection lifecycle: intake and prioritization, unit tests, replay against historical data, attack simulation, and regular reviews of coverage gaps, latency, false positives and MTTD; Stay hands-on: ship MITRE ATT&CK-aligned detections, threat hunts and automations in Panther and Python via Git and CI/CD; Own and improve the IR plan: severity model, roles, escalation, communications, on-call and playbooks; Build IR readiness: tabletop exercises, response automation and forensic readiness; Measure IR quality (MTTA/MTTR by severity, repeat incidents, action closure) and feed lessons back into detections, automation and process; Lead high-severity incidents as senior technical lead or incident commander; Use AI and agents for triage, enrichment, investigation and response, with guardrails and human-in-the-loop; Help define how to detect misuse of Apollo's own AI systems and agent features

Requirements

8+ years in detection and response, detection engineering, security engineering or incident response; Track record of leading D&R strategy or multi-quarter initiatives with measurable results; Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM (Panther highly valued); Strong Python, Git, CI/CD and detection-as-code skills; Experience leading high-severity incidents in cloud and SaaS environments and improving the IR process behind them; Cloud and SaaS expertise, ideally GCP, plus familiarity with tools like Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji and Snowflake; Sound judgment with incomplete information, and the influence to align technical and non-technical leaders without formal authority

Nice to have

Staff, Lead or Principal-level experience at a high-growth cloud or SaaS company; AI-assisted triage, investigation or response in production, with a clear view of its limits; Public security work (detection content, open-source tools, talks, research) or certifications such as GCIA, GCIH or GCED

Benefits

Equity; company bonus or sales commissions/bonuses; 401(k) plan; at least 10 paid holidays per year, flex PTO, and parental leave; employee assistance program and wellbeing benefits; global travel coverage; life/AD&D/STD/LTD insurance; FSA/HSA and medical, dental, and vision benefits