Senior Security Engineer - Security Assurance Scaling

Apple • Cupertino, CA

2d

About The Position

Apple Services Engineering (ASE), the team behind iCloud and Media services and the infrastructure that powers them, is seeking a Senior Security Engineer to partner with engineering teams working on new products and features. The role collaborates with developers, site reliability engineers, and security teams to protect ASE services and build a secure foundation for services at Apple.

The engineer scales security assurance activities, including security risk assessments, threat modeling, security reviews, and development of security standards. Working with security engineering, privacy, offensive security, infrastructure, and application teams, the role identifies where standards and controls should apply across ASE. Insights from engagements are used to establish standard methodologies, prioritize security capabilities, and advocate for platform-wide improvements that raise the security bar across engineering teams.

As a technical lead responsible for the security of Apple's internet-facing services and backend infrastructure, this person drives security decisions affecting millions of users. The role also identifies opportunities for automated enforcement and partners with security and platform engineering teams to embed controls consistently across teams and development workflows.

Requirements

• Eight or more years conducting security reviews, threat modeling, tracking findings, and communicating risk to engineering teams and leadership.
• Hands-on cloud security engineering experience, with demonstrated expertise securing at least one major cloud platform (AWS, GCP, or AliCloud) in production environments.
• Experience securing cloud-native applications and workloads, including containerized environments such as Kubernetes, EKS, or GKE; serverless architectures such as Lambda or Cloud Functions; and modern CI/CD pipelines.
• Experience building, evaluating, or directing the use of AI/ML-based security tooling to scale secure design review capacity and identify automation opportunities.
• Conversant in at least one programming language, such as Python, Java, Go, or Swift.
• Experience identifying and prioritizing security enforcement points within infrastructure-as-code and CI/CD pipelines, and partnering with platform or security engineering teams to embed controls consistently across many teams.
• Familiarity with policy-as-code approaches such as Open Policy Agent, Sentinel, or Checkov, sufficient to define control requirements and evaluate proposed implementations for coverage and risk reduction.

Nice To Haves

• Bachelor's degree or equivalent experience.

Responsibilities

• Partner with infrastructure and application teams to identify where security standards and controls should be applied across ASE.
• Work with engineering teams throughout the development lifecycle and conduct security reviews.
• Develop threat models and use engagement insights to build standard security methodologies.
• Assess and communicate security risks, track findings, and help prioritize security capabilities and controls.
• Partner with security engineering and other platform teams to enforce security controls.
• Define, prioritize, and advocate for platform-wide security improvements.
• Identify opportunities for automated security enforcement and partner with security and platform engineering teams to implement them.
• Use data to improve security review efficiency and prioritize high-value security team engagement.
• Make security decisions affecting Apple's internet-facing services, backend infrastructure, and millions of users.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior