Senior Security Software Engineer EDR

Apple • Seattle, WA

13h

About The Position

The Detection team within Apple Services Engineering (ASE) works to identify threat actors attacking Apple systems and services. The team partners with engineering groups to understand their systems and the threats they face, and builds endpoint detection and response (EDR) technology. The Swift-based agent runs on Linux (x86 and ARM64) and Apple operating systems on Apple silicon. It collects security telemetry, evaluates detections on the host, and takes response actions. It also supports Apple Private Cloud Compute (PCC), which extends Apple device privacy and security into the cloud and runs larger models behind Apple Intelligence.

The role focuses primarily on Apple’s internal servers, with some work supporting public-facing products used by hundreds of millions of people. The engineer will help expand the agent to protect a very large fleet while maintaining production reliability. This requires shipping capabilities quickly, treating releases as production-critical, and turning ambiguous, high-stakes problems into working software in collaboration with other teams. The role does not involve working from a predefined set of tickets.

Requirements

• At least 7 years of professional experience building, shipping, and supporting production software or system software.
• Proficiency in at least one high-level or scripting language, such as Python or Rust, and at least one low-level systems language, such as C or C++.
• Solid knowledge of operating system internals, including processes, threads, memory, system calls, and namespaces, on Linux, macOS, or both.
• Credible understanding of attacker behavior and security concepts, including how malicious activity appears in host telemetry such as process, network, and file events.
• Experience building or operating endpoint, host, or agent software deployed at large scale, with performance and availability objectives.

Nice To Haves

• Experience with eBPF, EndpointSecurity, or similar OS-level instrumentation, and understanding of how those mechanisms can be evaded or disabled.
• Experience with Swift on server, Swift concurrency, and cross-platform builds.
• Understanding of EDR or host-based detection techniques and the current industry state of the art.
• Experience with policy-driven detection logic, such as OPA/Rego, and statistical techniques such as probabilistic data structures for bounded-memory anomaly detection.
• Experience with virtualization and hypervisor environments.
• Experience building CI/CD and release tooling for software deployed to hosts, including staged rollout and rollback.

Responsibilities

• Build and expand Apple’s Swift-based endpoint detection and response agent.
• Develop software that collects security telemetry, evaluates detections on hosts, and takes response actions.
• Help protect a very large fleet while preserving production availability and reliability.
• Work with other teams to understand problems, decide what to build, and deliver working software.
• Build, ship, and support production or system software.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed