Principal Security Software Engineer, EDR

About the job

The Detection team within Apple Services Engineering (ASE) is responsible for finding any threat actors attacking approximately three quarters of Apple's systems and services. We do this by partnering closely with engineering teams to build a deep technical understanding of how their systems work, and a comprehensive understanding of the threats against them. A growing part of that mission is the endpoint detection and response (EDR) technology we build ourselves. It is a Swift-based agent that runs on Linux (x86 and ARM64) and on Apple operating systems running on Apple silicon. It collects security telemetry, evaluates detections directly on the host, and takes response action on the host. It also supports Apple's Private Cloud Compute (PCC), the system that extends the privacy and security of Apple devices into the cloud and runs the larger models behind Apple Intelligence. Most of your work will be on Apple's own internal servers, and some of it supports public-facing products used by hundreds of millions of people.

Description

We are looking for a Principal Engineer who will be the technical owner of what it takes to run this agent reliably on a very large fleet, and who will also keep the team shipping new capabilities quickly. You will own quality, reliability and operational excellence for the EDR. That includes the relationship with the Security SRE team, the platform-specific SRE teams, and the Tier 1, Tier 2 and Tier 3 support model that lets the agent run safely at scale. You will be a trusted owner of outcomes who can be handed an ambiguous, high-stakes problem and be expected to deliver, and to build a culture around you that learns from every failure. This role will leave a lasting impact on Apple's security posture, and by extension, the security of Apple's customers around the world.