Staff Security Ops Engineer — AI-Driven D&R & IR

Apolloio; United States; Remote; USD 225,000 - 338,000; Full time

Benefits offered by this job

Equity

401(k) plan

Bonus or commissions

Holidays (at least 10)

Flexible PTO

Parental leave

Wellbeing benefits

Job summary

Apollo.io is seeking a senior Detection & Response leader to define and drive multi-quarter D&R initiatives across our cloud and SaaS environments. You will own detection architecture, observability, and an AI-enabled response strategy, mentoring engineers to raise the security bar and improve incident readiness.

You will work with cross-functional teams to embed logging, telemetry and automated playbooks, while delivering measurable improvements in MTTA/MTTR and coverage.

Qualifications

• 8+ years in detection & response, detection engineering or incident response.
• Track record of leading D&R strategy or multi-quarter initiatives with measurable results.
• Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM (Panther highly valued).
• Strong Python, Git, CI/CD and detection-as-code skills.
• Experience leading high-severity incidents in cloud and SaaS environments and improving the IR process behind them.
• Cloud and SaaS expertise, ideally GCP, plus familiarity with tools like Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji and Snowflake.
• Sound judgment with incomplete information, and the influence to align technical and non-technical leaders without formal authority.

Responsibilities

• Own D&R strategy and translate it into multi-quarter initiatives tied to Security KRs.
• Collaborate with Engineering, Infrastructure and IT to plan logging, telemetry and response readiness.
• Set D&R standards: detections and response as code, review practices and playbook quality.
• Mentor engineers to own detections and lead incidents.
• Own detection architecture and the multi-quarter coverage plan: log sources, enrichment, correlation, alert routing, and cost at scale.
• Own security observability: telemetry onboarding and signal quality.
• Run the detection lifecycle: intake, testing, replay, attack simulation, and coverage reviews.
• Ship MITRE ATT&CK-aligned detections, threat hunts and automations via Git and CI/CD.
• Own and improve the IR plan: severity model, escalation, communications, on-call and playbooks.
• Lead tabletop exercises with Engineering, Legal, Fraud and leadership; drive automation and forensic readiness.
• Measure IR quality (MTTA/MTTR, repeat incidents) and feed lessons back into detections and processes.
• Lead high-severity incidents as senior technical lead or incident commander across cloud, SaaS and corporate systems.
• AI-native by default: define how we detect misuse of Apollo’s AI systems and enable AI-assisted responses.

Skills

Detection engineering

Incident response

Python

Git

CI/CD

Cloud & SaaS

Threat hunting

Infra & DevOps

Tools

Panther (SIEM)

Kubernetes

Docker

Terraform

GCP

Snowflake

GitHub

Okta

Job description

Apollo.io is seeking a senior Detection & Response leader to define and drive multi-quarter D&R initiatives across our cloud and SaaS environments. You will own detection architecture, observability, and an AI-enabled response strategy, mentoring engineers to raise the security bar and improve incident readiness.

You will work with cross-functional teams to embed logging, telemetry and automated playbooks, while delivering measurable improvements in MTTA/MTTR and coverage.