Sr Security Incident Response Engineer, AIS

Apple, Inc.; Seattle (WA); On-site; USD 167,000 - 251,000; Full time

Benefits offered by this job

Stock programs

Medical & dental

Retirement benefits

Educational expense reimbursement

Job summary

Apple Information Security is seeking a senior security incident response engineer to join its Incident Response team. The role focuses on identification, containment, and mitigation of security incidents on a follow-the-sun model.

You will drive complex investigations, set investigative quality standards, and turn learnings into durable capabilities. The role requires deep incident response expertise and collaboration across Apple’s global teams.

Qualifications

• B.S. in Computer Science, Engineering, or similar degree and/or equivalent 5+ years of Information Security experience.
• Ability to drive investigations independently and apply remediation strategies.
• Experience mentoring responders and improving team work.
• Experience with incident response automation strategies and tooling.
• Proficiency in one or more programming or scripting languages.

Responsibilities

• Own incidents end to end from detection to resolution and containment.
• Coach and mentor other responders to raise investigative quality.
• Build durable capabilities like detections, queries, and automations.
• Analyze incidents at scale with raw telemetry and multiple data sources.
• Collaborate with Apple units to strengthen security posture and response.

Skills

Incident response automation

Mentoring teammates

Threat modeling

Data analysis

Identity management knowledge

Malware analysis/forensics

Programming/scripting languages

Education

B.S. in Computer Science or Engineering

Job description

Sr Security Incident Response Engineer, AIS

Seattle, Washington, United States Corporate Functions

Imagine what you could do here. At Apple, new ideas have a way of becoming extraordinary products, services, and customer experiences very quickly.Apple Information Security is looking for an experienced Incident Response engineer to help protect Apple, our customers, and our data. This is work where the stakes are real, the scope is global and the decisions you make during an incident shape outcomes across the company.We're a diverse collection of thinkers and doers who are continually reimagining how threats get identified, contained, and mitigated. You'll bring deep technical judgment, the instinct to anticipate an attacker's next move rather than only recognize the last one, and work with other responders to build a stronger team. This is a deeply collaborative role where operations, critical thinking, and technology converge, and where you'll be trusted to own hard calls and build the capabilities the team relies for handling complex security incidents.Bring your passion and dedication to this job, and there's no telling what you could accomplish.

Description

Apple Information Security is seeking a senior security professional to join its Incident Response team. The successful candidate brings a proven technical background and substantial Information Security experience, with deep focus across the incident response lifecycle.You'll work with a global team of security professionals on a follow-the-sun model, focused primarily on the identification, containment, and mitigation of security incidents. You'll be trusted to drive complex, ambiguous investigations to resolution with minimal guidance, to set the bar for investigative quality, and to up-level the team around you. You'll also help move the function forward, turning what you learn in one investigation into durable capability the whole team benefits from. This person will have the opportunity to work on technology and processes with global reach.

Responsibilities

• Own incidents end to end: Handle and analyze security events and incidents, driving each through every stage to resolution. You'll form and test hypotheses, establish root cause, determine blast radius, and make containment and remediation decisions with minimal guidance — escalating with clear reasoning when the situation warrants it.
• Mentor and grow other responders: Coach less experienced members of the team, tailoring how you explain your thinking to what the other person already knows. You'll set the bar for investigative quality and help raise it across the function — this is a core expectation of the role, not a secondary one.
• Build durable capability: Turn one-off investigations into things that last: detections, queries, reusable processes, automations. You'll drive initiatives that scale incident response through creative technical solutions rather than additional headcount.
• Analyze at scale: Define strategies to scope incidents and surface risk through data analysis — working fluently with raw telemetry and context-switching across data sources under time pressure.
• Influence beyond the team: Partner with organizational units across Apple to strengthen security posture and processes, serving as a trusted technical advisor on response matters and bringing clarity to stakeholders with very different levels of context.
• Collaborate globally: Work as part of a distributed team protecting Apple, coordinating across time zones and functions to keep security a priority.
• Schedule and coverage: This role primarily follows a Monday through Friday schedule, with an on-call rotation covering weekends and holidays. A shift-based schedule may also be required in the future.

Minimum Qualifications

• B.S. in Computer Science, Engineering, or similar degree and/or equivalent 5+ years of experience in Information Security with a focus on Incident Response, Security Engineering, and/or Intrusion Detection, including significant hands-on response work
• Demonstrated ability to drive investigations independently — comfortable testing hypotheses, establishing root cause, and applying policy and remediation strategies
• Demonstrated experience mentoring and coaching other responders, sharing expertise in a way that measurably improves the work of those around you
• Strong understanding of incident response automation strategies, with a track record of implementing them
• Proficiency in one or more programming or scripting languages

Preferred Qualifications

• Proven ownership of complex, ambiguous problems through to resolution, with sound judgment about what to decide and when to elevate
• Strong understanding of threat modeling, operational threat intelligence, and common attack vectors
• Strong understanding on AI to apply innovation into IR processes through controlled, replicable and traceable strategies.
• Deep working knowledge of modern identity management, with the ability to reason about and determine blast radius within an incident
• Practical understanding of attacker tradecraft sufficient to anticipate the next step rather than only recognize the last one
• Has repeatedly turned a one-off investigation into durable capability — a detection, a query, a reusable process
• Curiosity about emerging attack surfaces and vectors
• Fluency analyzing large-scale datasets, context-switching between data sources, and working directly with raw telemetry during investigations
• Working competence across several of: endpoint/OS internals, cloud control planes, SaaS platforms, corporate IT infrastructure, and developer/CI-CD environments
• Experience in malware analysis, digital forensics, intrusion detection, and/or threat intelligence
• Technical certifications are a plus (OSCP, GIAC, CCNP/CCIE, and similar)
• Excellent verbal and written communication skills, including the ability to brief audiences with varying levels of technical context

At Apple, base pay is one part of our total compensation package and is determined within a range. This provides the opportunity to progress as you grow and develop within a role. The base pay range for this role is between $166,600 and $250,700, and your base pay will depend on your skills, qualifications, experience, and location.

You’ll also receive benefits including:

• Apple employees also have the opportunity to become an Apple shareholder through participation in Apple’s discretionary employee stock programs.
• Apple employees are eligible for discretionary restricted stock unit awards, and can purchase Apple stock at a discount if voluntarily participating in Apple’s Employee Stock Purchase Plan.
• Comprehensive medical and dental coverage
• retirement benefits
• a range of discounted products and free services
• reimbursement for certain educational expenses — including tuition
• discretionary bonuses or commission payments as well as relocation

Learn more about Apple Benefits

Note: Apple benefit, compensation and employee stock programs are subject to eligibility