Staff Engineer, Security Operations
New
A
Apollo.ioCybersecurity SaaS
Remote, United StatesFull-TimeStaff
SalaryTier 1 Pay Range (San Francisco, New York City, Seattle) $259,200 — $388,900 USD; Tier 2 Pay Range (All other US Locations) $225,400 — $338,100 USD. The listed Pay Range reflects the total cash compensation inclusive of annual base salary and annual bonus as applicable.
Apply NowOpens the employer's application page
Job Details
- Experience
- 8+ years in detection and response, detection engineering, security engineering or incident response.
- Required Skills
- PythonGCPGitCI/CD
Requirements
- Have 8+ years of experience in detection and response, detection engineering, security engineering, or incident response.
- Have a track record of leading D&R strategy or multi-quarter initiatives with measurable results.
- Have hands-on experience designing detection architecture and shipping detection systems on a modern SIEM; Panther is highly valued.
- Have strong Python, Git, CI/CD, and detection-as-code skills.
- Have experience leading high-severity incidents in cloud and SaaS environments and improving the incident response process.
- Bring cloud and SaaS expertise; GCP experience is preferred.
- Be familiar with tools such as Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, and Snowflake.
- Demonstrate sound judgment with incomplete information and the ability to align technical and non-technical leaders without formal authority.
- Staff, Lead, or Principal-level experience at a high-growth cloud or SaaS company is a plus.
- Production experience with AI-assisted triage, investigation, or response is a plus.
- Public security work or certifications such as GCIA, GCIH, or GCED are a plus.
Responsibilities
- Own the detection and response strategy and translate it into multi-quarter initiatives tied to Security KRs.
- Coordinate with Engineering, Infrastructure, and IT to plan logging, telemetry, and response readiness in their roadmaps.
- Set standards for detections and response as code, review practices, playbook quality, and AI-assisted workflows.
- Own detection architecture and the coverage plan for log sources, enrichment, correlation, alert routing, and cost.
- Onboard telemetry, improve signal quality, incorporate threat intelligence, and tune alerts.
- Run the detection lifecycle, including prioritization, unit tests, historical-data replay, attack simulation, and coverage reviews.
- Ship MITRE ATT&CK-aligned detections, threat hunts, and automations using Panther, Python, Git, and CI/CD.
- Improve the incident response plan, readiness, response automation, and forensic readiness.
- Lead high-severity incidents across cloud, SaaS, and corporate systems, and use incident lessons to improve detections, automation, and processes.
- Use and evaluate AI and agents for triage, enrichment, investigation, and response, with appropriate guardrails.
View Full Description & ApplyYou'll be redirected to the employer's site
