Senior Security Engineer - Strategic Risk

Apple•Seattle, WA

About The Position

The Apple Services Engineering Security team builds and provides secure systems and infrastructure for Apple services, including iCloud, iTunes, Siri, the App Store, and Maps. As part of the team, the Senior Security Engineer will help manage security needs across Apple’s services worldwide and develop and integrate security controls, guardrails, and frameworks to protect customer data in Apple’s infrastructure. The role serves as the primary security point of contact for several large engineering efforts, partnering with engineering teams throughout development. The engineer conducts security reviews, post-incident reviews, and investigations; develops threat models; and uses engagement insights to create scalable security methodologies. The role also defines, automates, and advocates for application-level and platform-wide security improvements, with a focus on risks to customer accounts and data. It includes hands-on involvement in reviewing, adjusting, implementing, and testing programs, as well as developing AI technologies to manage risk.

Requirements

At least 7 years conducting security reviews, incident response, threat modeling, or security engineering.
Demonstrated ability to design, document, and implement new security processes.
Understanding of cloud-native architecture and managed platform services, such as compute, storage, networking, and databases.
Expertise in threat modeling, operational threat intelligence, and common attack vectors and frameworks.
Understanding of applied cryptography, access control, modern authentication frameworks, and other security mechanisms.
Experience with enterprise log collection and analysis platforms, such as Splunk or OSQuery.
Experience with threat hunting, insider risk, and/or investigations.
Experience working with data engineers to define metrics and interpret results from detection and risk models.
Experience applying and experimenting with AI/ML to solve security-related use cases.

Responsibilities

Identify areas for improvement in user account security and establish appropriate security goals.
Lead discovery conversations to understand architecture, current security posture, and adoption blockers.
Measure and communicate risks to leaders and stakeholders.
Develop and implement AI technologies to manage risk.
Perform post-incident reviews and investigations.
Research emerging technologies, threats, and vulnerabilities to define security requirements and controls before they reach production.
Partner with teams to improve the security of their services and systems.
Conduct security reviews and threat modeling throughout engineering development lifecycles.
Define, automate, and advocate for application-level and platform-wide security improvements focused on customer accounts and data.
Review, adjust, implement, and test security programs.