Staff Security Engineer - AI-Driven Security Assurance

Apple•Seattle, WA

About The Position

Apple Services Engineering (ASE), which supports iCloud, Media services, and their underlying infrastructure, is seeking a security engineer to partner with engineering teams in building AI-driven security assurance capabilities. The role collaborates with developers, site reliability engineers, and security teams to protect ASE services and establish a secure foundation for Apple services. It includes scaling security risk assessments, threat modeling, and security standards, in partnership with security engineering, privacy, and offensive security teams. This hands-on engineering role combines security architecture, threat modeling, security design reviews, and spec-driven development (SDD) with applied AI experience. The engineer will design and develop AI-powered assurance systems using large language models, autonomous agents, and organization-specific security context to identify and prevent risk across complex systems and architectures. The role also defines how security is incorporated into SDD, so that security requirements, threat models, abuse cases, trust boundaries, controls, and verification criteria are established early and maintained through specification, implementation, testing, and the broader development lifecycle. The engineer will work closely with software engineers, architects, and product teams developing agent technology, helping shape secure design and integrate security throughout the software development lifecycle. Responsibilities include building agentic workflows, applying retrieval and memory techniques to ground AI systems in organizational context, evaluating AI-generated assessments, and integrating assurance capabilities into engineering workflows and security infrastructure.

Requirements

10 or more years of hands-on experience in security assurance, with demonstrated depth in security architecture, threat modeling, security design reviews, and security risk assessment.
Experience evaluating AI system performance, including reliability, correctness, failure modes, and effectiveness against defined objectives.
Proficiency in Python or a comparable programming language, API integration, and production software development.
Experience with LLM orchestration, agent tool use, retrieval systems, context engineering, and techniques for grounding AI outputs in trusted organizational data.
Experience incorporating security into spec-driven development, requirements engineering, secure design practices, or comparable structured software development methodologies.

Nice To Haves

Bachelor’s degree or equivalent experience is preferred.
Experience applying generative AI or agentic automation to security assurance, threat modeling, architecture, reviews, vulnerability analysis, or spec-driven development.
Experience building enterprise knowledge systems using RAG, knowledge graphs, persistent memory, or hybrid retrieval techniques.
Experience integrating AI agents with engineering tools, source code, repositories, architecture, documentation, specifications, requirements systems, and security assessment workflows.
Experience establishing traceability between specifications, security requirements, implementation artifacts, tests, and assurance evidence.

Responsibilities

Architect, develop, and deploy AI-powered security assurance systems to automate and augment security design reviews, threat modeling, and architectural risk assessments.
Define and implement security practices for spec-driven development, including security requirements, abuse cases, threat models, trust boundaries, control objectives, and security acceptance criteria.
Integrate security analysis and verification into the SDD lifecycle, covering specification, design, implementation, testing, and change review.
Build agentic workflows that analyze complex system architectures and specifications, reason about threats, identify potential vulnerabilities, and produce actionable findings.
Implement context-management approaches, including retrieval-augmented generation (RAG), persistent agent memory, and other techniques that help AI systems reason within the organization’s security environment.
Apply evaluation frameworks to measure the accuracy, completeness, reliability, and security effectiveness of AI-generated assessments and SDD outputs.
Integrate AI-driven assurance capabilities into engineering workflows and existing security infrastructure to increase coverage without proportionally increasing manual review effort.
Evaluate emerging AI models, agent frameworks, and engineering techniques to identify improvements to security assurance capabilities.
Partner with security engineers, architects, and engineering teams to turn complex security requirements and expert judgment into reusable, automated assurance capabilities.
Collaborate with developers, site reliability engineers, and security teams to protect ASE services and develop security improvements.
Work with security engineering, privacy, and offensive security partners to keep Apple services secure.