Staff Engineer, Detection and Response

This is a fully remote position, open to applicants in United States.

📋 Description

• Direct the detection and response strategy for Apollo’s Security team.

• Develop detection systems, automation for responses, and tools for investigations.

• Oversee complex and critical incidents across cloud, SaaS, and corporate systems.

• Manage multi-quarter Detection and Response (D&R) initiatives linked to Security Key Results (KRs) and report on progress and risks to leadership.

• Collaborate with Engineering, Infrastructure, and IT on logging, telemetry, and response preparedness.

• Establish standards for detections and response as code, review methodologies, playbook excellence, and AI-assisted workflows.

• Guide engineers and enhance the hiring process.

• Take charge of detection architecture, planning coverage, security observability, and alert tuning.

• Manage the detection lifecycle, including prioritization, testing, historical playback, attack simulations, and coverage evaluations.

• Deliver MITRE ATT&CK-compliant detections, threat hunts, and automations using Panther and Python via Git and CI/CD.

• Refine the incident response plan, severity framework, escalation processes, communication strategies, on-call protocols, and playbooks.

• Enhance incident response readiness through tabletop simulations, automation of responses, and forensic preparedness.

• Evaluate the quality of incident response through MTTA, MTTR, recurring incidents, and action completion.

• Set benchmarks for AI-enhanced detection and response, measuring improvements in speed, coverage, and signal quality.

• Develop detection strategies for potential misuse of Apollo’s AI systems and agent functionalities.

⛳️ Requirements

• Over 8 years of experience in detection and response, detection engineering, security engineering, or incident response.

• Proven history of leading D&R strategies or multi-quarter initiatives with quantifiable outcomes.

• Practical experience in designing detection architecture and deploying detection systems on a modern SIEM; experience with Panther is highly valued.

• Proficient in Python, Git, CI/CD, and detection-as-code methodologies.

• Experience leading high-severity incidents in cloud and SaaS settings and enhancing the incident response process.

• Expertise in cloud and SaaS technologies, preferably GCP.

• Familiar with Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, and Snowflake.

• Ability to make sound judgments with incomplete information.

• Capacity to influence and align both technical and non-technical leaders without formal authority.

🏝️ Benefits

• Equity.

• Company bonus.

• 401(k) plan.

• Minimum of 10 paid holidays annually.

• Flexible PTO.

• Parental leave.

• Employee assistance program.

• Wellbeing benefits.

• Global travel coverage.

• Life, AD&D, STD, and LTD insurance.

• FSA/HSA.

• Medical, dental, and vision benefits.

• Resources, support, and autonomy for professional development.