SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 225,400 - 281,800 / annual
Apollo.io is a leading go-to-market platform trusted by over 500,000 companies globally, providing sales and marketing teams with verified B2B contact data and engagement tools. Founded in 2015, Apollo has raised approximately $250 million and is valued at $1.6 billion, backed by top-tier investors including Sequoia Capital and Bain Capital Ventures.
The Staff Application Security Engineer leads Apollo's application security strategy and delivers it through hands-on technical work and leadership. This role tackles the most complex AppSec challenges across product, platform, and AI-powered features—problems without established playbooks.
Key responsibilities include:
**AppSec Strategy & Influence:** Lead Apollo's multi-year AppSec strategy, translating it into cross-team initiatives that drive Security department KRs. Shape Engineering, Product, Platform, and Data roadmaps to integrate security early. Set secure design, code review, and risk model standards across the department, including expectations for AI-generated and agent-generated code. Mentor senior engineers and security champions to scale the AppSec program beyond any single person.
**Secure Architecture & Vulnerability Management:** Lead security architecture reviews and threat modeling for high-scale, multi-team systems including AI and agent features. Design and drive adoption of secure-by-default building blocks (shared authorization, safe OAuth/token handling, SSRF-safe HTTP clients). Shape vulnerability management across internal reviews, bug bounty, pentests, and SCA/runtime findings with focus on root causes and risk-based severity. Stay hands-on for the hardest cases: read code across teams, develop exploits, test bypasses, and lead variant analysis and staged remediation.
**AI-Augmented AppSec & Tooling:** Set the standard for AI-augmented AppSec in the department. Use AI and agents for code review, threat modeling, triage, and remediation. Build automation that teams outside Security adopt, with measured gains in speed, coverage, and signal quality. Define how Apollo secures its AI systems and agent features, including input/output handling, AI-exposed APIs, prompt and response guardrails, tool permissions, and data-exfiltration paths.
Success looks like: owning AppSec strategy across a multi-year horizon and getting it committed in other teams' roadmaps; solving ambiguous, no-playbook problems and defining approaches for others to follow; making hard risk calls under ambiguity and aligning technical and non-technical leaders without formal authority; building guardrails, standards, and people so AppSec scales beyond any one person.
Tech stack: React (frontend); Ruby, Ruby on Rails, Python, MongoDB, Elasticsearch (backend); Kubernetes, Docker, Terraform (infrastructure); GCP (cloud).
**Requirements:**
- Track record of leading AppSec strategy that changed how several engineering teams build, with measurable results, typically backed by 10+ years in software engineering or application security
- Expert code review, penetration testing, and exploit development skills; ability to find design flaws in unfamiliar codebases and land fixes that hold up against bypass attempts
- Strong software development skills and ability to ship production code; Ruby and Ruby on Rails experience highly valuable; Python a plus; strong Linux and cloud fundamentals, ideally GCP and Kubernetes
- Deep experience with secure architecture and authentication/authorization patterns; experience building security building blocks that other teams adopt
- Hands-on experience securing AI-powered systems or agent features; clear point of view on how AI changes application security
- Judgment to make hard risk calls under ambiguity; influence to align technical and non-technical leaders without formal authority
**Preferred Qualifications:**
- Experience leading security for AI-native products, internal agents, or AI-assisted engineering workflows at scale
- Experience building or scaling a security champions or developer enablement program
- Public security work (CVEs, research, talks, open-source tools) or certifications (OSCP, OSWE)
