Staff Security Detection & Incident Response Engineer

Apollo Group; United States; Remote; USD 259,000 - 389,000; Full time

Benefits offered by this job

Equity

401(k) plan

10+ paid holidays per year

Flexible PTO

Parental leave

Employee assistance program

Wellbeing benefits

Global travel coverage

Life/AD&D/LTD insurance

FSA/HSA and medical, dental, vision

Job summary

Apollo.io seeks a senior Security leader to own detection and response strategy, building detections and response automation across cloud and SaaS environments. You’ll drive multi‑quarter initiatives, mentor engineers, and lead high‑severity incidents as incident commander.

We expect hands‑on experience designing detection architecture, strong Python and CI/CD skills, and familiarity with Panther and modern SIEM practices. AI‑native by default, with extensive benefits and equity.

Qualifications

• 8+ years in detection and response, detection engineering, security engineering or incident response.
• Track record of leading D&R strategy or multi‑quarter initiatives with measurable results.
• Hands‑on experience designing detection architecture and shipping detection systems on a modern SIEM (Panther highly valued).
• Strong Python, Git, CI/CD and detection‑as‑code skills.
• Experience leading high‑severity incidents in cloud and SaaS environments and improving the IR process behind them.
• Cloud and SaaS expertise, ideally GCP, plus familiarity with tools like Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji and Snowflake.

Responsibilities

• Own D&R strategy and turn it into multi‑quarter initiatives tied to Security KRs.
• Report progress and risks to leadership in business terms.
• Work with Engineering, Infrastructure and IT so logging, telemetry and response readiness are planned into roadmaps early.
• Set D&R standards: detections and response as code, review practices, playbook quality, and AI‑assisted workflows.
• Mentor engineers to own detections and lead incidents, and help raise the hiring bar.
• Own detection architecture and the multi‑quarter coverage plan: log sources, enrichment, correlation, alert routing, and cost at scale.
• Own security observability: telemetry onboarding, signal quality, threat intel inputs and alert tuning.
• Run the detection lifecycle: intake and prioritization, unit tests, replay against historical data, attack simulation, and regular reviews of coverage gaps, latency, false positives and MTTD.
• Stay hands‑on: ship MITRE ATT&CK‑aligned detections, threat hunts and automations in Panther and Python via Git and CI/CD.
• Own and improve the IR plan: severity model, roles, escalation, communications, on‑call and playbooks for our top scenarios.
• Build IR readiness: tabletop exercises with Engineering, Legal, Fraud and leadership, plus response automation and forensic readiness.
• Measure IR quality (MTTA/MTTR by severity, repeat incidents, action closure) and feed lessons back into detections, automation and process.
• Lead high‑severity incidents as senior technical lead or incident commander across cloud, SaaS and corporate systems.

Skills

Detection strategy

Security engineering

Incident response

Leadership & mentoring

CI/CD

Detection‑as‑code

AI‑assisted workflows

Strong Python

GCP expertise

Cloud & SaaS security

Education

Bachelor's degree in CS/related field

Tools

Panther

Python

GCP

Kubernetes

Docker

Terraform

Google Workspace

Okta

GitHub

Slack

Atlassian

Cloudflare

CrowdStrike

Kandji

Snowflake

AI tools (Claude, Cursor)

Job description

Apollo.io seeks a senior Security leader to own detection and response strategy, building detections and response automation across cloud and SaaS environments. You’ll drive multi‑quarter initiatives, mentor engineers, and lead high‑severity incidents as incident commander.

We expect hands‑on experience designing detection architecture, strong Python and CI/CD skills, and familiarity with Panther and modern SIEM practices. AI‑native by default, with extensive benefits and equity.