Senior Security Engineer - Security Assurance Scaling

Apple • Seattle, WA

4d

About The Position

Apple Services Engineering (ASE), the team behind iCloud, Media services, and their supporting infrastructure, is seeking a Senior Security Engineer to partner with engineering teams developing new products and features. The role collaborates with developers, site reliability engineers, security teams, and partners in security engineering, privacy, and offensive security to protect ASE services and establish a secure foundation for Apple services.

The engineer will scale security assurance activities, including security risk assessments, threat modeling, and development of security standards. They will partner with infrastructure and application teams to identify where standards and controls should be applied, conduct security reviews throughout the development lifecycle, and use engagement insights to build standard methodologies. As a security risk expert for these services, the engineer will prioritize security capabilities and controls and work with security and platform teams to enforce them. The role also defines, prioritizes, and advocates for platform-wide improvements, and serves as a technical lead responsible for the security of Apple's internet-facing services and backend infrastructure.

Requirements

• At least 8 years conducting security reviews, threat modeling, tracking findings, and communicating risk to engineering teams and leadership.
• Hands-on cloud security engineering experience, with demonstrated expertise securing at least one major cloud platform—AWS, GCP, or AliCloud—in production environments.
• Experience securing cloud-native applications and workloads, including containerized environments such as Kubernetes/EKS/GKE, serverless architectures such as Lambda/Cloud Functions, and modern CI/CD pipelines.
• Experience building, evaluating, or directing the use of AI/ML-based security tooling to scale secure design review capacity and identify automation opportunities.
• Conversant in at least one programming language, such as Python, Java, Go, or Swift.

Nice To Haves

• Bachelor's degree or equivalent experience preferred.
• Experience identifying and prioritizing security enforcement points in infrastructure-as-code and CI/CD pipelines, and partnering with platform or security engineering teams to embed controls consistently across many teams.
• Familiarity with policy-as-code approaches such as Open Policy Agent, Sentinel, or Checkov sufficient to define control requirements and evaluate proposed implementations for coverage and risk reduction.

Responsibilities

• Partner with infrastructure and application teams to identify where security standards and controls should be applied across ASE.
• Work with engineering teams throughout the development lifecycle, conduct security reviews, and develop threat models.
• Use security review insights to build standard methodologies.
• Prioritize security capabilities and controls for ASE services and partner with security engineering and platform teams to enforce them.
• Define, prioritize, and advocate for platform-wide security improvements.
• Identify opportunities for automated enforcement and partner with security and platform engineering teams to implement it.
• Use data to improve security review efficiency and prioritize high-value security team engagement.
• Make security decisions affecting Apple's internet-facing services, backend infrastructure, and millions of users.
• Build relationships with teams to drive security improvements and stay current on security technologies, vulnerabilities, and methodologies.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed