About The Position
The Foundational Security team in Apple Services Engineering secures the low-level foundations of Apple's datacenter fleet, including hardware-backed trust, disk encryption, and systems used to manage servers below the operating system. This senior engineer will take technical ownership of the platform that manages baseboard management controllers, set its engineering and security standards, shape how access is granted and verified, and lead its modernization toward standards-based management. The role works closely with datacenter operations, SRE, hardware, network, and detection teams, and serves as a subject-matter expert on securely managing Apple's fleet. The role owns the design, code, and security of a privileged, availability-critical service, including writing and reviewing production code. It involves identifying and reducing risks in authentication, authorization, and credential handling, and making privileged activity visible to detection teams. The engineer will help modernize fleet management and coordinate with internal teams and tools that depend on the platform. The engineer will help define secure out-of-band management at Apple, including access segmentation across environments, trusted firmware delivery, security requirements for management controllers in future hardware, and access for automated systems as well as people.
Requirements
- 8+ years of software engineering experience, including end-to-end ownership of a production system or platform.
- Deep proficiency in Go, with 5+ years writing production Go code.
- Experience building security telemetry for SIEM and detection pipelines, such as Splunk or OpenTelemetry.
- Hands-on experience with authentication and authorization at scale, including PKI, mTLS, X.509 certificate identity, and fine-grained access control.
- Experience with Swift and Rust.
- BS/MS in Computer Science or equivalent experience.
Nice To Haves
- Hands-on experience with server management technologies such as IPMI, DMTF Redfish, OpenBMC, or vendor BMCs such as HPE iLO or Dell iDRAC.
- Experience finding and fixing security flaws in networked services through code review, threat modeling, or security testing.
- Technical leadership experience driving architecture decisions and cross-team migrations, mentoring engineers, and explaining security trade-offs to engineers and leadership.
- Experience with gRPC and Protocol Buffers, and with running PostgreSQL in production.
- Experience managing the lifecycle of secrets and credentials at fleet scale, including rotation and emergency access.
- Experience building and operating highly available, distributed services that other teams depend on.
- Familiarity with network segmentation and zero-trust access patterns, such as identity-aware proxies.
- Knowledge of firmware security, including secure boot, firmware signing and updates, TPMs, and hardware roots of trust.
- Hands-on experience using AI coding assistants on a production codebase.
Responsibilities
- Own the design, code, and security of a privileged, availability-critical service.
- Write and review production code.
- Identify and reduce risks in the service's authentication, authorization, and credential handling.
- Make privileged activity visible to teams responsible for detecting misuse.
- Modernize fleet management and coordinate with internal teams and tools that depend on the platform.
- Define secure out-of-band management practices, including environment access segmentation, trusted firmware delivery, future management-controller requirements, and access for automated systems.
- Drive technical ownership of the platform that manages baseboard management controllers.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
