Staff Security Engineer - AI-Driven Security Assurance

Apple•Seattle, WA

About The Position

Apple Services Engineering (ASE), which supports iCloud, Media services, and their underlying infrastructure, is seeking a security engineer to partner with engineering teams on AI-driven security assurance. The role collaborates with developers, site reliability engineers, and security teams to protect ASE services and establish a secure foundation for Apple services. It includes scaling security risk assessments, threat modeling, and security standards in partnership with security engineering, privacy, and offensive security teams. This hands-on role combines security architecture, threat modeling, security design review, and spec-driven development with applied AI engineering. The engineer will design and develop intelligent security assurance capabilities using large language models, autonomous agents, and organization-specific security context to identify and prevent meaningful risks across complex systems and architectures. The role also helps incorporate security into spec-driven development, establishing security requirements, threat models, abuse cases, trust boundaries, controls, and verification criteria early and carrying them through specification, implementation, testing, and the software development lifecycle. The engineer will partner with software engineers, architects, and product teams working on agent technology to influence secure design and development.

Requirements

10 or more years of hands-on experience in security assurance.
Demonstrated depth in security architecture, threat modeling, security design reviews, and security risk assessment.
Experience evaluating AI system performance, including reliability, correctness, failure modes, and effectiveness against defined objectives.
Proficiency in Python or a comparable programming language, API integration, and production software development.
Experience with LLM orchestration, agent tool use, retrieval systems, context engineering, and techniques for grounding AI outputs in trusted organizational data.
Experience incorporating security into spec-driven development, requirements engineering, secure design practices, or comparable structured software development methodologies.

Nice To Haves

Bachelor's degree or equivalent experience.
Experience applying generative AI or agentic automation to security assurance, threat modeling, architecture, reviews, vulnerability analysis, or spec-driven development.
Experience building enterprise knowledge systems using RAG, knowledge graphs, persistent memory, or hybrid retrieval techniques.
Experience integrating AI agents with engineering tools, source code, repositories, architecture, documentation, specifications, requirements systems, and security assessment workflows.
Experience establishing traceability between specifications, security requirements, implementation artifacts, tests, and assurance evidence.

Responsibilities

Partner with engineering teams to build AI-driven security assurance capabilities for Apple Services Engineering.
Protect ASE services and help design a secure foundation for Apple services in collaboration with developers, site reliability engineers, and security teams.
Scale security assurance activities, including security risk assessments, threat modeling, and development of security standards.
Design and develop intelligent security assurance capabilities using large language models, autonomous agents, and organization-specific security context.
Identify and prevent meaningful security risks across complex systems and architectures.
Incorporate security into spec-driven development, establishing security requirements, threat models, abuse cases, trust boundaries, controls, and verification criteria early in the lifecycle.
Carry security considerations through specification, implementation, testing, and the software development lifecycle.
Partner with software engineers, architects, and product teams to understand emerging agent capabilities and influence how agentic systems are designed and developed.
Integrate security throughout the software development lifecycle.
Evaluate AI system performance, including reliability, correctness, failure modes, and effectiveness against defined objectives.