Sr Security Incident Response Engineer, AIS

Apple • Austin, TX

9d

About The Position

Apple Information Security is seeking a senior security professional to join its Incident Response team and help protect Apple, its customers, and its data. The role focuses primarily on identifying, containing, and mitigating security incidents as part of a global team working on a follow-the-sun model. The successful candidate will drive complex and ambiguous investigations to resolution with minimal guidance, set a high standard for investigative quality, and help strengthen the team’s capabilities.

The engineer will own incidents through the full response lifecycle, from testing hypotheses and establishing root cause to determining blast radius and making containment and remediation decisions. They will mentor other responders, turn lessons from investigations into durable capabilities such as detections, queries, reusable processes, and automations, and use data analysis to scope incidents and surface risk. The role also partners with organizational units across Apple as a trusted technical advisor and coordinates with a distributed team across time zones and functions.

The role primarily follows a Monday through Friday schedule, with an on-call rotation covering weekends and holidays. A shift-based schedule may also be required in the future.

Requirements

• Bachelor’s degree in Computer Science, Engineering, or a similar field, or equivalent.
• At least 5 years of Information Security experience focused on Incident Response, Security Engineering, and/or Intrusion Detection, including significant hands-on incident response work.
• Ability to drive investigations independently, test hypotheses, establish root cause, and apply policy and remediation strategies.
• Experience mentoring and coaching responders and sharing expertise in ways that measurably improve others’ work.
• Strong understanding of incident response automation strategies and a track record of implementing them.
• Proficiency in one or more programming or scripting languages.
• Ownership of complex, ambiguous problems through resolution, with sound judgment about what to decide and when to escalate.
• Strong understanding of threat modeling, operational threat intelligence, and common attack vectors.
• Strong understanding of AI and its application to incident response processes through controlled, replicable, and traceable strategies.
• Deep working knowledge of modern identity management and the ability to determine incident blast radius.
• Practical understanding of attacker tradecraft sufficient to anticipate likely next steps.
• Experience turning one-off investigations into durable capabilities such as detections, queries, or reusable processes.
• Curiosity about emerging attack surfaces and vectors.
• Fluency analyzing large-scale datasets, switching between data sources, and working directly with raw telemetry.
• Working competence across several of endpoint/OS internals, cloud control planes, SaaS platforms, corporate IT infrastructure, and developer/CI-CD environments.
• Excellent verbal and written communication skills, including the ability to brief audiences with varying levels of technical context.

Nice To Haves

• Experience in malware analysis, digital forensics, intrusion detection, and/or threat intelligence.
• Technical certifications such as OSCP, GIAC, CCNP/CCIE, or similar.

Responsibilities

• Handle and analyze security events and incidents, driving each through every stage of the incident response lifecycle to resolution.
• Form and test hypotheses, establish root cause, determine incident blast radius, and make containment and remediation decisions with minimal guidance; escalate with clear reasoning when warranted.
• Coach less experienced team members, tailor explanations to their knowledge, and raise investigative quality across the function.
• Turn investigations into durable capabilities, including detections, queries, reusable processes, and automations.
• Drive initiatives that scale incident response through creative technical solutions.
• Define strategies to scope incidents and surface risk through data analysis, using raw telemetry and multiple data sources under time pressure.
• Partner with organizational units across Apple to strengthen security posture and processes, serving as a trusted technical advisor on response matters.
• Coordinate across time zones and functions as part of a distributed global security team.
• Work primarily Monday through Friday and participate in an on-call rotation covering weekends and holidays; shift-based scheduling may be required in the future.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior