Sr Security Incident Response Engineer, AIS

Apple•Austin, TX

About The Position

Apple Information Security is seeking a senior security professional to join its Incident Response team. The role focuses primarily on identifying, containing, and mitigating security incidents as part of a global team operating on a follow-the-sun model. The engineer will drive complex and ambiguous investigations to resolution with minimal guidance, set a high standard for investigative quality, and help strengthen the capabilities of other responders. The role also involves turning lessons from individual investigations into durable capabilities that benefit the team, and advancing technology and processes with global reach. It requires deep technical judgment, substantial incident response experience, independent decision-making, and close collaboration with other responders.

Requirements

B.S. in Computer Science, Engineering, or a similar degree, and/or equivalent experience.
At least 5 years of Information Security experience focused on Incident Response, Security Engineering, and/or Intrusion Detection, including significant hands-on response work.
Ability to drive investigations independently, test hypotheses, establish root cause, and apply policy and remediation strategies.
Experience mentoring and coaching other responders in ways that measurably improve their work.
Strong understanding of incident response automation strategies and a track record of implementing them.
Proficiency in one or more programming or scripting languages.

Nice To Haves

Ownership of complex, ambiguous problems through resolution, with sound judgment about when to decide and when to escalate.
Strong understanding of threat modeling, operational threat intelligence, and common attack vectors.
Strong understanding of AI and how to apply it to incident response processes using controlled, replicable, and traceable strategies.
Deep working knowledge of modern identity management and the ability to determine incident blast radius.
Practical understanding of attacker tradecraft sufficient to anticipate likely next steps.
Experience turning one-off investigations into durable capabilities, such as detections, queries, or reusable processes.
Curiosity about emerging attack surfaces and vectors.
Fluency analyzing large-scale datasets, switching between data sources, and working directly with raw telemetry during investigations.
Working competence across several of endpoint/OS internals, cloud control planes, SaaS platforms, corporate IT infrastructure, and developer/CI-CD environments.
Experience in malware analysis, digital forensics, intrusion detection, and/or threat intelligence.
Technical certifications such as OSCP, GIAC, CCNP/CCIE, or similar.
Excellent verbal and written communication skills, including the ability to brief audiences with varying levels of technical context.

Responsibilities

Identify, contain, and mitigate security incidents.
Drive complex and ambiguous investigations to resolution with minimal guidance.
Test investigative hypotheses, establish root cause, and apply policy and remediation strategies.
Set a high standard for investigative quality.
Mentor and coach other responders, sharing expertise to improve team performance.
Implement incident response automation strategies.
Turn investigation findings into durable team capabilities, such as detections, queries, and reusable processes.
Help advance incident response technology and processes with global reach.
Use controlled, replicable, and traceable strategies to apply AI innovation to incident response processes.
Communicate investigation findings to audiences with varying levels of technical context.