Staff Engineer, Detection and Response

Responsibilities

• Own Apollo’s detection and response strategy and translate it into multi-quarter initiatives tied to Security KRs.
• Set detection and response standards, architecture, review practices, playbook quality, and AI-assisted workflows.
• Design detection architecture, security observability, telemetry onboarding, threat intelligence inputs, alert routing, and coverage plans.
• Build and maintain MITRE ATT&CK-aligned detections, threat hunts, response automations, and investigation tools using Panther and Python.
• Run detection lifecycle processes including prioritization, unit testing, historical replay, attack simulation, alert tuning, and coverage reviews.
• Own and improve the incident response plan, including severity models, escalation, communications, on-call processes, and playbooks.
• Lead high-severity incidents as a senior technical lead or incident commander across cloud, SaaS, and corporate environments.
• Mentor engineers, coordinate with Engineering, Infrastructure, IT, Legal, Fraud, and leadership, and help raise the hiring bar.
• Use AI and agents for triage, enrichment, investigation, and response with appropriate guardrails and human oversight.

Requirements

• 8+ years of experience in detection and response, detection engineering, security engineering, or incident response.
• Track record of leading detection and response strategy or multi-quarter initiatives with measurable results.
• Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM; Panther experience is highly valued.
• Strong Python, Git, CI/CD, and detection-as-code skills.
• Experience leading high-severity incidents in cloud and SaaS environments and improving incident response processes.
• Cloud and SaaS expertise, ideally including GCP, and familiarity with Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, and Snowflake.
• Experience with AI-assisted triage, investigation, or response in production is valued.
• Public security work or certifications such as GCIA, GCIH, or GCED are valued.
• Strong judgment with incomplete information and the ability to influence technical and non-technical leaders without formal authority.

Benefits

• Potential equity, company bonus, 401(k), at least 10 paid holidays annually, flexible PTO, parental leave, employee assistance and wellbeing benefits, global travel coverage, insurance, and FSA/HSA plus medical, dental, and vision benefits.
• The listed pay range is $225,400—$281,800 USD in total cash compensation, inclusive of annual base salary and annual bonus as applicable.
• Applicants outside the US may request the annual salary range for their location during the interview process.