Senior Security Engineer

Apple•Seattle, WA

About The Position

Apple Services Engineering (ASE), the team behind iCloud services and the infrastructure that powers it, is seeking a Senior Security Engineer to partner with engineering teams developing new products and features. The role collaborates with developers, site reliability engineers, and security teams to protect ASE services and design secure platforms and services at Apple. The engineer leads security efforts early in the design phase through threat modeling and security guidance, and works with security engineering, privacy, and offensive security partners to protect Apple services. Serving as the primary security point of contact for several large engineering efforts, the engineer works with engineering teams throughout the development lifecycle, conducts security reviews, develops threat models, and uses engagement insights to build scalable methodologies. The role also helps define, automate, and advocate for platform-wide security improvements, raising the security bar across Apple engineering teams. As a technical lead responsible for the security of Apple’s internet-facing services and backend infrastructure, the engineer identifies weaknesses and improvement opportunities, establishes security goals, builds relationships to drive improvements, guides workable secure designs and informed risk decisions, and stays current on security technologies, vulnerabilities, and methodologies. The role may develop proof-of-concept systems to automate security recommendations, vulnerability discovery, and workflows; use data to improve review efficiency and prioritize high-value engagements; and make security decisions affecting millions of users.

Requirements

10 or more years conducting security reviews, threat modeling, tracking findings, and communicating risk to engineering and leadership.
Knowledge of distributed systems design patterns and their security implications when developing cloud-scale platform services.
Deep understanding of cloud-native architecture and managed platform services, such as compute, storage, networking, and databases.
Experience with multi-tenant system design and securing multi-tenant software-as-a-service and platform-as-a-service offerings.
Conversant in at least one programming language, such as Python, Java, Go, or Swift.
Experience with security standard processes in third-party cloud environments.
Innate curiosity and ability to investigate technical systems and understand their weaknesses.
Ability to establish relationships and drive security improvements with partner teams.
Ability to guide partners toward secure designs and informed risk decisions.
Current knowledge of security technologies, vulnerabilities, and methodologies.

Nice To Haves

Bachelor’s degree or equivalent experience is preferred.
Community contributions such as public CVEs, bug bounty recognition, open-source tools, or blogs.
Experience securing container orchestration systems such as Kubernetes and understanding security implications in multi-tenant environments.
Experience with Artificial Intelligence and Machine Learning.

Responsibilities

Partner with engineering teams building new products and features to protect ASE services and design secure platforms and services.
Lead security implementation early in the design phase through threat modeling and security guidance.
Work with security engineering, privacy, and offensive security partners to protect Apple services.
Serve as the primary security team point of contact for several large engineering efforts throughout their development lifecycle.
Conduct security reviews, develop threat models, track findings, and communicate risk to engineering teams and leadership.
Use engagement insights to develop scalable security methodologies.
Define, automate, and advocate for platform-wide security improvements.
Identify security weaknesses and improvement opportunities, and establish appropriate security goals.
Build relationships with engineering teams and guide them toward workable secure designs and informed risk decisions.
Develop proof-of-concept systems to automate security recommendations, vulnerability discovery, and process workflows.
Use data to improve security review efficiency and prioritize high-value engagements.
Make security decisions affecting millions of users.