Principal Security Software Engineer, EDR

Apple • Seattle, WA

2d

About The Position

The Detection team within Apple Services Engineering (ASE) identifies threat actors targeting Apple’s systems and services. The team partners with engineering teams to understand their systems and the threats facing them, and develops endpoint detection and response (EDR) technology. The EDR agent is written in Swift and runs on Linux (x86 and ARM64) and Apple operating systems on Apple silicon. It collects security telemetry, evaluates detections on the host, and takes response actions there. It also supports Apple’s Private Cloud Compute (PCC), which extends the privacy and security of Apple devices into the cloud and runs larger models behind Apple Intelligence. Most of the work supports Apple’s internal servers, with some supporting public-facing products used by hundreds of millions of people.

The Principal Engineer will serve as the technical owner for operating the agent reliably across a very large fleet while enabling the team to deliver new capabilities quickly. The role owns EDR quality, reliability, and operational excellence, including relationships with Security SRE and platform-specific SRE teams and the Tier 1, Tier 2, and Tier 3 support model. The engineer is expected to take ownership of ambiguous, high-stakes problems, deliver outcomes, and foster a culture that learns from failures. The work is intended to have a lasting impact on Apple’s security posture and the security of its customers.

Requirements

• 15+ years of professional experience building, shipping, and supporting production software or system software; seniority is assessed by scope, ownership, and impact as well as years.
• Strong hands-on experience with Swift on server and C for eBPF and kernel-level code.
• Experience owning the reliability of a critical production system, including availability and performance objectives, rollout safety, and operational readiness.
• Experience leading incident response and writing or leading post-mortems.
• Demonstrated history of building a reliability learning culture through blameless reviews, follow-through on corrective actions, and measurable improvement.
• Proficiency in at least one high-level or scripting language, such as Python or Rust, and at least one low-level systems language, such as C or C++.
• Strong knowledge of operating system internals, including processes, threads, memory, system calls, and namespaces.
• Experience with Linux, macOS, or both.
• Credible understanding of attacker behavior, security concepts, and how malicious activity appears in host telemetry.

Nice To Haves

• Ability to participate in a Tier 3 support rotation and lead the design of the agent’s support model.
• Experience developing Tier 1 and Tier 2 support runbooks and partnering with and training SREs to use them.
• Public contributions such as open-source work, talks, papers, or blog posts.
• Experience building or operating endpoint, host, or agent software deployed at very large scale with strict performance and availability objectives.
• Experience defining a tiered support and escalation model involving both non-developer SRE teams and development teams.
• Experience with eBPF, EndpointSecurity, or similar OS-level instrumentation, and understanding of how such mechanisms can be evaded or disabled.
• Experience with Swift on server, Swift concurrency, and cross-platform builds.
• Understanding of EDR or host-based detection techniques and the current industry state of the art.
• Experience with policy-driven detection logic, such as OPA/Rego, and statistical techniques such as probabilistic data structures for bounded-memory anomaly detection.
• Experience with virtualization and hypervisor environments.

Responsibilities

• Own the technical approach to running the EDR agent reliably across a very large fleet.
• Maintain quality, reliability, and operational excellence for the EDR agent.
• Own the relationship with the Security SRE team and platform-specific SRE teams.
• Own the Tier 1, Tier 2, and Tier 3 support model that enables safe operation at scale.
• Deliver outcomes for ambiguous, high-stakes problems.
• Build a team culture that learns from failures.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal
• Education Level: No Education Listed