Build Security Engineer

Apple is where individual imaginations gather together committing to the values that lead to great work. Every new product we build service we create or Apple Store experience we deliver is the result of us making each others ideas stronger. That happens because every one of us shares a belief that we can make something wonderful and share it with the world changing lives for the better. Its the diversity of our people and their thinking that inspires the innovation that runs through everything we do. When we bring everybody in we can do the best work of our lives. Here youll do more than join something youll add is often referred to as the soul of Apples products. This role sits at the intersection of security and software engineering with direct responsibility for protecting the systems and infrastructure used to manage build and distribute Apples software. The Build Security Engineer will conduct threat modeling and security assessments partner with engineering teams to uphold security standards and develop technical solutions that strengthen Apples build infrastructure security posture end to end.

The Build Security Engineer is a key contributor to the security of Apples software supply chain. This role requires deep technical security expertise applied across threat modeling offensive security assessments and the development of security controls all in close collaboration with the engineering teams who build and maintain Apples most critical software infrastructure. The role also involves creating documentation mentoring teammates and staying current with the evolving threat landscape to proactively address risk.

Conducts threat modeling and security assessments of critical build infrastructure regularly updating models to reflect evolving threats and changes in the with engineering teams to ensure adherence to defined security standards and requirements providing guidance on the implementation of security implements and maintains technical solutions to mitigate identified security risks within the software build and maintains test cases to validate the effectiveness and resilience of security penetration tests and red team exercises with a focus on the software build path and related critical vulnerabilities in critical software components used across the environment and recommends proactive and maintains documentation outlining security guidelines and best practices for engineering teams.

3 years of experience in cybersecurity with hands-on experience in threat modeling security assessments or penetration testingnExperience in a software engineering or security operations rolenExperience with scripting or programming languages such as Python or BashnExperience working cross-functionally with engineering teams on security requirements or controls

Experience conducting penetration testing or red team exercises particularly targeting build pipelines or software supply chain componentsnExperience leveraging LLMs safely to accelerate various security workflowsnExperience with container orchestration platforms such as KubernetesnProficiency in additional programming languages such as Go (Golang) or PerlnFamiliarity with cybersecurity frameworks and standards (e.g. NIST CIS SLSA)nExperience mentoring engineers or junior security team members on security concepts and best practicesnTrack record of identifying and driving remediation of vulnerabilities in complex software environmentsnStrong written and verbal communication skills with the ability to present technical findings to varied audiencesnSecurity certifications such as OSCP or CISSP