Staff Engineer, Security Operations

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee the detection and response strategy for Apollo’s Security team while engaging in hands-on delivery.

• Develop detection systems, automate responses, and create investigation tools.

• Lead the management of complex and high-severity incidents across cloud, SaaS, and corporate systems.

• Take ownership of the detection and response strategy and convert it into multi-quarter initiatives aligned with Security key results.

• Communicate progress and risks to leadership using business-centric terminology.

• Collaborate with Engineering, Infrastructure, and IT teams on logging, telemetry, and readiness for response.

• Establish standards for detection and response, including coding practices, playbook quality, and AI-assisted workflows.

• Provide mentorship to engineers and assist in elevating the hiring standards.

• Manage detection architecture and plan for multi-quarter coverage.

• Oversee security observability, telemetry onboarding, signal quality, threat intelligence inputs, and alert tuning.

• Facilitate the detection lifecycle, which includes intake, prioritization, unit testing, historical replay, attack simulation, and coverage reviews.

• Deliver MITRE ATT&CK-aligned detections, threat hunts, and automations using Panther and Python through Git and CI/CD.

• Enhance and manage the incident response plan, severity model, roles, escalation procedures, communications, on-call duties, and playbooks.

• Conduct tabletop exercises with Engineering, Legal, Fraud teams, and leadership.

• Create automation for responses and ensure forensic readiness.

• Measure metrics such as Mean Time to Acknowledge (MTTA), Mean Time to Resolve (MTTR), repeat incidents, and action closures.

• Utilize AI and agents for triage, enrichment, investigation, and response while implementing appropriate guardrails.

• Define detection strategies for the misuse of Apollo’s AI systems and agent functionalities.

⛳️ Requirements

• Minimum of 8 years in detection and response, detection engineering, security engineering, or incident response.

• Proven history of leading detection and response strategies or multi-quarter initiatives with measurable outcomes.

• Practical experience in designing detection architecture and deploying detection systems on a contemporary SIEM; experience with Panther is highly regarded.

• Proficiency in Python, Git, CI/CD, and detection-as-code methodologies.

• Experience managing high-severity incidents in cloud and SaaS settings and enhancing the incident response process associated with them.

• Expertise in cloud and SaaS, preferably with GCP.

• Familiarity with tools such as Google Workspace, Okta, GitHub, Slack, Atlassian, Cloudflare, CrowdStrike, Kandji, and Snowflake.

• Demonstrated sound judgment in situations with incomplete information.

• Capability to influence both technical and non-technical leaders without direct authority.

🏝️ Benefits

• Equity.

• Company bonus or sales commissions/bonuses.

• 401(k) plan.

• Minimum of 10 paid holidays each year.

• Flexible paid time off (PTO).

• Parental leave.

• Employee assistance program.

• Wellbeing benefits.

• Global travel coverage.

• Life insurance.

• Accidental Death and Dismemberment (AD&D) insurance.

• Short-Term Disability (STD) insurance.

• Long-Term Disability (LTD) insurance.

• Flexible Spending Account (FSA) / Health Savings Account (HSA).

• Medical benefits.

• Dental benefits.

• Vision benefits.

• Resources, support, and autonomy for professional development.