Senior Security Software Engineer EDR

Apple Inc.; Seattle (WA); On-site; USD 175,000 - 309,000; Full time

Benefits offered by this job

Medical and dental coverage

Employee stock programs (RSUs)

Tuition reimbursement

Job summary

Apple Inc. is seeking an exceptional engineer to grow an in-house Swift-based agent that protects a vast fleet across Linux, macOS, and Apple Silicon. You will design and ship capabilities with an emphasis on reliability, ensuring releases run on production hosts.

You’ll work with cross-functional teams to understand what to build and how, treating each release with production-grade rigor and avoiding predefined tickets.

Qualifications

• 7+ years of professional experience building, shipping and supporting production software or system software.
• Solid knowledge of operating system internals (processes, threads, memory, system calls, namespaces). Linux, macOS or both.
• Credible understanding of attacker behavior and security concepts, and of how malicious activity shows up in host telemetry.

Responsibilities

• Develop and harden a Swift-based agent that runs on Linux and Apple operating systems.
• Scale the endpoint detection agent to protect a very large fleet without production downtime.
• Collaborate with multiple teams to translate vague, high-stakes problems into reliable software.

Skills

Python/Rust

C/C++

OS internals

Security concepts

Telemetry/forensics

Tools

eBPF

EndpointSecurity

Swift (server)

Job description

Seattle, Washington, United States Software and Services

The Detection team within Apple Services Engineering (ASE) is responsible for finding any threat actors attacking approximately three quarters of Apple's systems and services. We do this by partnering closely with engineering teams to build a deep technical understanding of how their systems work, and a comprehensive understanding of the threats against them.A growing part of that mission is the endpoint detection and response (EDR) technology we build ourselves. It is a Swift-based agent that runs on Linux (x86 and ARM64) and on Apple operating systems running on Apple silicon. It collects security telemetry, evaluates detections directly on the host, and takes response action on the host. It also supports Apple's Private Cloud Compute (PCC), the system that extends the privacy and security of Apple devices into the cloud and runs the larger models behind Apple Intelligence. Most of your work will be on Apple's own internal servers, and some of it supports public-facing products used by hundreds of millions of people.

Description

We are looking for an exceptional engineer to help us grow this agent to protect a very large fleet, and to do it without ever taking production down. You will bring two things at once: the engineering depth to ship new capabilities quickly, and a reliability mindset that treats every release as something that runs on production hosts. You will take vague, high-stakes problems and turn them into working software, working with other teams to find out what to build and how. This is not a role where you will be handed pre-defined tickets.

Minimum Qualifications

• 7+ years of professional experience building, shipping and supporting production software or system software.
• Personal proficiency, in at least one high-level or scripting language (Python or Rust) and at least one low-level systems language (C or C++).
• Solid knowledge of operating system internals (processes, threads, memory, system calls, namespaces). Linux, macOS or both.
• Credible understanding of attacker behavior and security concepts, and of how malicious activity shows up in host telemetry such as process, network and file events.

Preferred Qualifications

• Experience building or operating endpoint, host or agent software deployed at large scale, with performance and availability objectives.
• Experience with eBPF, EndpointSecurity or similar OS-level instrumentation, and an understanding of how those mechanisms can be evaded or disabled.
• Experience with Swift on server, concurrency in Swift, and cross-platform builds.
• Understanding of EDR or host-based detection techniques and the current industry state of the art.
• Experience with policy-driven detection logic (for example OPA/Rego), and with statistical techniques such as probabilistic data structures for bounded-memory anomaly detection.
• Experience with virtualization and hypervisor environments.
• Experience building CI/CD and release tooling for software deployed to hosts, including staged rollout and rollback.

At Apple, base pay is one part of our total compensation package and is determined within a range. This provides the opportunity to progress as you grow and develop within a role. The base pay range for this role is between $175,000 and $308,500, and your base pay will depend on your skills, qualifications, experience, and location.

Apple employees also have the opportunity to become an Apple shareholder through participation in Apple’s discretionary employee stock programs. Apple employees are eligible for discretionary restricted stock unit awards, and can purchase Apple stock at a discount if voluntarily participating in Apple’s Employee Stock Purchase Plan. You’ll also receive benefits including: Comprehensive medical and dental coverage, retirement benefits, a range of discounted products and free services, and for formal education related to advancing your career at Apple, reimbursement for certain educational expenses — including tuition. Additionally, this role might be eligible for discretionary bonuses or commission payments as well as relocation. Learn more about Apple Benefits

Note: Apple benefit, compensation and employee stock programs are subject to eligibility requirements and other terms of the applicable plan or program.

Apple is an equal opportunity employer that is committed to inclusion and diversity. We seek to promote equal opportunity for all applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, Veteran status, or other legally protected characteristics. Learn more about your EEO rights as an applicant

At Apple, we believe accessibility is a fundamental human right. You’ll find that idea reflected in everything here — in our culture, our benefits and our digital tools. By welcoming as many perspectives as possible, we help you build a career where you feel like you belong.

Learn about accessibility in Apple’s workplace

Learn about reasonable accommodations for job applicants

Apple accepts applications to this posting on an ongoing basis.