Principal Security Software Engineer, EDR

The Detection team within Apple Services Engineering (ASE) is responsible for finding any threat actors attacking approximately three quarters of Apples systems and services. We do this by partnering closely with engineering teams to build a deep technical understanding of how their systems work and a comprehensive understanding of the threats against growing part of that mission is the endpoint detection and response (EDR) technology we build ourselves. It is a Swift-based agent that runs on Linux (x86 and ARM64) and on Apple operating systems running on Apple silicon. It collects security telemetry evaluates detections directly on the host and takes response action on the host. It also supports Apples Private Cloud Compute (PCC) the system that extends the privacy and security of Apple devices into the cloud and runs the larger models behind Apple Intelligence. Most of your work will be on Apples own internal servers and some of it supports public-facing products used by hundreds of millions of people.n

nWe are looking for a Principal Engineer who will be the technical owner of what it takes to run this agent reliably on a very large fleet and who will also keep the team shipping new capabilities quickly. You will own quality reliability and operational excellence for the EDR. That includes the relationship with the Security SRE team the platform-specific SRE teams and the Tier 1 Tier 2 and Tier 3 support model that lets the agent run safely at scale. You will be a trusted owner of outcomes who can be handed an ambiguous high-stakes problem and be expected to deliver and to build a culture around you that learns from every failure. This role will leave a lasting impact on Apples security posture and by extension the security of Apples customers around the world.

15 years of professional experience building shipping and supporting production software or system software. Seniority here is defined by scope ownership and impact not only hands-on experience with Swift on server C for eBPF and kernel-level code nExperience owning the reliability of a critical production system including its availability and performance objectives rollout safety and operational readiness. nExperience leading incident response and written or led post-mortems and has a demonstrated history of building a reliability learning culture in a team or organization (blameless reviews follow-through on corrective actions measurable improvement).nPersonal proficiency in at least one high-level or scripting language (Python or Rust) and at least one low-level systems language (C or C). nStrong knowledge of operating system internals (processes threads memory system calls namespaces). Linux macOS or bothnCredible understanding of attacker behavior and security concepts and of how malicious activity shows up in host telemetry.

Ability to participate in a Tier 3 support rotation and to lead the design of the support model for the developing Tier 1 and Tier 2 support runbooks and partnering with and training SREs to use contributions such as open source work talks papers or blog building or operating endpoint host or agent software deployed at very large scale with strict performance and availability defining a tiered support and escalation model with a mix of non-developer SRE teams and development with eBPF EndpointSecurity or similar OS-level instrumentation and an understanding of how those mechanisms can be evaded or with Swift on server concurrency in Swift and cross-platform of EDR or host-based detection techniques and the current industry state of the with policy-driven detection logic (for example OPA/Rego) and with statistical techniques such as probabilistic data structures for bounded-memory anomaly with virtualization and hypervisor environments.n