SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 225,400 - 281,800 / annual
Apollo.io is a leading go-to-market platform trusted by over 500,000 companies globally, providing sales and marketing teams with verified contact data and engagement tools. Founded in 2015, the company has raised ~$250M and is valued at $1.6B, backed by Sequoia Capital and Bain Capital Ventures.
You will lead detection and response (D&R) strategy for Apollo's Security team while remaining hands-on. You'll build detection systems, response automations, and investigation tools rapidly, lead complex incidents, and establish standards and architecture that enable the team to catch and contain threats without single-point-of-failure dependencies.
Key responsibilities include:
**Strategy and Influence:** Own D&R strategy and translate it into multi-quarter initiatives tied to Security KRs, reporting progress to leadership in business terms. Partner with Engineering, Infrastructure, and IT to integrate logging, telemetry, and response readiness into their roadmaps early. Set D&R standards around detections-as-code, review practices, playbook quality, and AI-assisted workflows. Mentor engineers to own detections and lead incidents.
**Detection Engineering and Observability:** Own detection architecture and multi-quarter coverage planning (log sources, enrichment, correlation, alert routing, cost at scale). Manage security observability including telemetry onboarding, signal quality, threat intelligence inputs, and alert tuning. Run the full detection lifecycle: intake, prioritization, unit tests, historical replay, attack simulation, and regular reviews of coverage gaps, latency, false positives, and MTTD. Stay hands-on shipping MITRE ATT&CK-aligned detections, threat hunts, and automations in Panther and Python via Git and CI/CD.
**Incident Response:** Own and improve the IR plan including severity model, roles, escalation, communications, on-call procedures, and playbooks for top scenarios. Build IR readiness through tabletop exercises with Engineering, Legal, Fraud, and leadership, plus response automation and forensic readiness. Measure IR quality (MTTA/MTTR by severity, repeat incidents, action closure) and feed lessons back into detections, automation, and process. Lead high-severity incidents as senior technical lead or incident commander across cloud, SaaS, and corporate systems.
**AI-Native Approach:** Set standards for AI-augmented D&R, using AI and agents for triage, enrichment, investigation, and response with appropriate guardrails and human-in-the-loop controls. Measure gains in speed, coverage, and signal quality. Help define detection strategies for misuse of Apollo's own AI systems and agent features.
Tech stack includes Panther (SIEM), Python, GCP, Kubernetes, Docker, Terraform, Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, Snowflake, and AI tools like Claude and Cursor.
**Requirements:**
- 8+ years in detection and response, detection engineering, security engineering, or incident response
- Track record of leading D&R strategy or multi-quarter initiatives with measurable results
- Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM (Panther highly valued)
- Strong Python, Git, CI/CD, and detection-as-code skills
- Experience leading high-severity incidents in cloud and SaaS environments and improving IR processes
- Cloud and SaaS expertise, ideally GCP, plus familiarity with Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, and Snowflake
- Sound judgment with incomplete information and ability to influence technical and non-technical leaders without formal authority
**Nice to have:**
- Staff, Lead, or Principal-level experience at a high-growth cloud or SaaS company
- AI-assisted triage, investigation, or response in production with clear understanding of limitations
- Public security work (detection content, open-source tools, talks, research) or certifications such as GCIA, GCIH, or GCED
