Staff Security Operations Engineer - D&R Architect & IR Lead

Apollo.io; San Francisco (CA); On-site; USD 184,000 - 265,000; Full time

Benefits offered by this job

Equity

401(k) plan

At least 10 paid holidays per year

Flex PTO

Parental leave

Employee assistance program

Wellbeing benefits

Global travel coverage

Life/AD&D/STD/LTD insurance

Medical, dental, and vision benefits

Job summary

Apollo.io is seeking an experienced leader to own detection and response strategy for its Security team in a dynamic, AI-native environment. You will build detection systems, automate responses, and guide incident investigations while setting standards for detection-as-code and playbooks.

You'll mentor engineers, align logging and telemetry with roadmaps, and drive multi-quarter initiatives across cloud and SaaS.

Qualifications

• 8+ years in detection and response, detection engineering, security engineering or incident response.
• Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM (Panther highly valued).
• Strong Python, Git, CI/CD and detection-as-code skills.
• Experience leading high-severity incidents in cloud and SaaS environments.

Responsibilities

• Own D&R strategy and multi-quarter initiatives tied to Security KRs.
• Build detection systems, response automations and investigation tools.
• Lead high-severity incidents as senior technical lead or incident commander.
• Ship MITRE ATT&CK-aligned detections and automations, and improve IR plans.

Skills

Python

Git

CI/CD

detection-as-code

Incident response

Cloud

SaaS

Leadership

Tools

Panther

GitHub

CI/CD pipelines

Google Workspace

Okta

Slack

Atlassian

Snowflake

Job description

Apollo.io is seeking an experienced leader to own detection and response strategy for its Security team in a dynamic, AI-native environment. You will build detection systems, automate responses, and guide incident investigations while setting standards for detection-as-code and playbooks.

You'll mentor engineers, align logging and telemetry with roadmaps, and drive multi-quarter initiatives across cloud and SaaS.