AI Security Engineer - Red Team

Apple•Seattle, WA

About The Position

Apple Services Engineering’s Security Red Team conducts deep technical security reviews of critical services and infrastructure. The AI Security Engineer leads focused reviews of critical, internet-scale AI deployments, including agents, MCPs, platforms, and supporting infrastructure. The role works closely with AI platform teams, security engineering, InfoSec, privacy, SRE, detection, and design review teams to identify security weaknesses, validate and design detection mechanisms, and provide actionable recommendations. The engineer learns each service’s AI architecture and risk profile to establish a meaningful review scope. Reviews focus on the use and relevant risks of deployed AI models; the models themselves remain out of scope. The role identifies obscure and complex risks in AI integrations and deployments, including business-logic risks requiring deep understanding of agents, MCPs, models, services, and architecture. It also develops repeatable testing frameworks and metrics-driven improvements, uses AI to expedite work while remaining accountable for outcomes, and identifies risks or review areas that AI tools and processes may miss.

Requirements

At least 6 years in information security or software engineering, including at least 2 years conducting security reviews.
At least 1 year reviewing AI deployments such as MCPs and agents.
At least 2 years of manual source-code review to help find vulnerabilities.
Experience building or contributing to AI tools or AI security tools.
Ability to adapt quickly to changing priorities and investigate unfamiliar technologies.
Extensive infrastructure, cloud, and application security experience.
Experience communicating risk to engineering teams and leadership.
Bachelor’s degree in Computer Science, Engineering, or a related field with emphasis in security-related fields, or equivalent experience.
Ability to reason about and influence software architecture for security.

Nice To Haves

At least 8 years in information security, including at least 4 years conducting security reviews.
Community contributions such as public CVEs, bug bounty recognition, open-source tools, blogs, or talks.

Responsibilities

Enumerate risks, plan security reviews, and execute them to identify vulnerabilities and improvement opportunities.
Scope and lead focused security reviews of critical internet-scale AI deployments, including agents, MCPs, platforms, and supporting infrastructure.
Learn services’ AI architectures and risk profiles to create meaningful review scopes focused on the use and relevant risks of deployed AI models, with the models themselves out of scope.
Identify uncommon, obscure, and complex risks within AI deployments and AI platforms, including complex business-logic risks.
Validate and design detection mechanisms and provide actionable recommendations to enhance security posture.
Collaborate with AI architecture and engineering teams to continuously validate and improve security controls and detection capabilities.
Develop repeatable testing frameworks and metrics-driven security improvements.
Use AI to expedite work while maintaining accountability for outcomes; identify risks requiring further review after AI-assisted initial reviews.
Develop proof-of-concept systems to automate security recommendations, vulnerability discovery, and process workflows.
Identify areas for security improvement, establish appropriate security goals, and contribute improvement opportunities to AI tool and process engineering teams.
Stay current on new security technologies, vulnerabilities, and methodologies.
Communicate security risks to engineering teams and leadership.
Reason about and influence software architecture for security.