SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 225,400 - 388,900 / annual
Apollo.io is a $1.6B-valued, venture-backed B2B SaaS platform trusted by over 500,000 companies for go-to-market solutions. The company provides sales and marketing teams with verified contact data for 210M+ B2B contacts and 35M companies, plus engagement and conversion tools in a unified platform.
You will lead detection and response (D&R) strategy for Apollo's Security team, delivering it hands-on. You'll build detection systems, response automations, and investigation tools rapidly, lead complex incidents, and establish standards and architecture that enable the team to catch and contain threats without single-point-of-person dependencies.
Key responsibilities include:
**Strategy and Influence:** Own D&R strategy and translate it into multi-quarter initiatives tied to Security KRs, reporting progress to leadership in business terms. Partner with Engineering, Infrastructure, and IT to embed logging, telemetry, and response readiness into their roadmaps early. Set D&R standards around detections-as-code, review practices, playbook quality, and AI-assisted workflows. Mentor engineers to own detections and lead incidents.
**Detection Engineering and Observability:** Own detection architecture and multi-quarter coverage planning (log sources, enrichment, correlation, alert routing, cost at scale). Own security observability including telemetry onboarding, signal quality, threat intelligence inputs, and alert tuning. Run the detection lifecycle: intake, prioritization, unit tests, historical replay, attack simulation, and regular reviews of coverage gaps, latency, false positives, and MTTD. Stay hands-on shipping MITRE ATT&CK-aligned detections, threat hunts, and automations in Panther and Python via Git and CI/CD.
**Incident Response:** Own and improve the IR plan (severity model, roles, escalation, communications, on-call, playbooks). Build IR readiness through tabletop exercises with Engineering, Legal, Fraud, and leadership, plus response automation and forensic readiness. Measure IR quality (MTTA/MTTR by severity, repeat incidents, action closure) and feed lessons back into detections, automation, and process. Lead high-severity incidents as senior technical lead or incident commander across cloud, SaaS, and corporate systems.
**AI-Native Approach:** Set the standard for AI-augmented D&R, using AI and agents for triage, enrichment, investigation, and response with appropriate guardrails and human-in-the-loop controls. Measure gains in speed, coverage, and signal quality. Help define detection of misuse of Apollo's own AI systems and agent features.
Success is measured by: a D&R strategy tied to Security KRs with telemetry work committed in other teams' roadmaps; improved detection coverage and precision for top threats with a tested IR process delivering faster MTTD/MTTR and fewer repeat incidents; and AI-assisted triage and response in production with measurable reduction in manual toil.
Tech stack includes Panther (SIEM), Python, GCP, Kubernetes, Docker, Terraform, Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, Snowflake, and AI tools like Claude and Cursor.
**Requirements:**
- 8+ years in detection and response, detection engineering, security engineering, or incident response
- Track record of leading D&R strategy or multi-quarter initiatives with measurable results
- Hands-on experience designing detection architecture and shipping detection systems on a modern SIEM (Panther highly valued)
- Strong Python, Git, CI/CD, and detection-as-code skills
- Experience leading high-severity incidents in cloud and SaaS environments and improving the IR process
- Cloud and SaaS expertise, ideally GCP, plus familiarity with Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, and Snowflake
- Sound judgment with incomplete information and ability to influence technical and non-technical leaders without formal authority
**Nice to Have:**
- Staff, Lead, or Principal-level experience at a high-growth cloud or SaaS company
- AI-assisted triage, investigation, or response in production with clear understanding of limitations
- Public security work (detection content, open-source tools, talks, research) or certifications such as GCIA, GCIH, or GCED
