Senior Security Software Engineer EDR

Apple • Seattle, WA

2d

About The Position

The Detection team within Apple Services Engineering (ASE) protects Apple systems and services by partnering with engineering teams to understand their systems and the threats they face. The team builds a Swift-based endpoint detection and response (EDR) agent that runs on Linux (x86 and ARM64) and Apple operating systems on Apple silicon. The agent collects security telemetry, evaluates detections on the host, and takes response actions. It also supports Private Cloud Compute (PCC), which extends the privacy and security of Apple devices into the cloud and runs larger models behind Apple Intelligence. Most of the work supports Apple's internal servers, with some work supporting public-facing products used by hundreds of millions of people.

The engineer will help expand the agent to protect a very large fleet while maintaining production reliability. The role calls for quickly delivering new capabilities with a reliability mindset, translating vague, high-stakes problems into working software, and collaborating with other teams to determine what to build and how. Work is not limited to predefined tickets.

Requirements

• At least 7 years of professional experience building, shipping, and supporting production software or system software.
• Proficiency in at least one high-level or scripting language, such as Python or Rust, and at least one low-level systems language, such as C or C++.
• Solid knowledge of operating system internals, including processes, threads, memory, system calls, and namespaces.
• Experience with Linux, macOS, or both.
• Credible understanding of attacker behavior and security concepts, including how malicious activity appears in host telemetry such as process, network, and file events.

Nice To Haves

• Experience building or operating endpoint, host, or agent software deployed at large scale with performance and availability objectives.
• Experience with eBPF, EndpointSecurity, or similar OS-level instrumentation, including understanding how these mechanisms can be evaded or disabled.
• Experience with Swift on server, Swift concurrency, and cross-platform builds.
• Understanding of EDR or host-based detection techniques and the current industry state of the art.
• Experience with policy-driven detection logic, such as OPA/Rego, and statistical techniques such as probabilistic data structures for bounded-memory anomaly detection.
• Experience with virtualization and hypervisor environments.
• Experience building CI/CD and release tooling for host-deployed software, including staged rollout and rollback.

Responsibilities

• Build and expand Apple's Swift-based endpoint detection and response agent for a very large fleet.
• Develop agent capabilities for collecting security telemetry, evaluating detections on hosts, and taking response actions.
• Deliver software safely and reliably for production hosts.
• Turn high-stakes, loosely defined problems into working software.
• Work with other teams to determine what to build and how.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed