Senior Software Engineer Security

We are the software supply chain security team part of Apple Services Engineering (ASE) Security org. We work on the software behind iCloud App Store Apple Music TV and Commerce. Our job is to make software Apple can trust: know what goes into it catch the security problems in it before they ship and keep unsafe code out of production. Engineering teams across Apple Services build against the tooling we provide. The near-term work is assurance signal. Scanners design reviews and code analysis produce findings faster than anyone can judge them so engineers hand-triage noise and stop trusting the output. That triage step sets the ceiling on how much assurance we can run and on how much of it our partner teams act on. We are building automated security assurance that produces findings engineers trust: agentic and LLM-driven analysis wrapped in the evaluation harnesses and guardrails that keep non-deterministic components honest as inputs targets and models change. The longer-term agenda is the supply chain itself. Today nobody can answer questions about a running service without a person spending a day chasing registries build systems and scanners: what went into this build where each dependency came from who owns fixing it when it goes bad. We are building the paved path that answers those questions by construction through dependency risk management build and release integrity artifact signing and verification and policy-based admission of software into runtime. We are looking for a Senior Software Engineer to design write and ship production software. Success here takes strong distributed systems engineering real judgment about where agentic components belong and where they dont and the ability to make security controls show up in other teams existing workflows without becoming a tax.

This is a highly collaborative hands-on role where you will partner with infrastructure platform and product security teams to build the tooling and services that other engineers across Apple depend on to develop ship and operate services securely at scale. You will be accountable for producing quality software that meets service-level objectives. Your everyday activities will include designing implementing testing and operating security services and features including scanning and assurance tooling agentic and LLM-integrated components backends and APIs and the integrations that make security work show up in developers existing workflows. You will participate in code and security reviews to help your peers meet a high bar for the software they ship. You will do research prototyping and present ideas designs and results to your team management and internal customers. You are expected to own significant components end to end and to remain close to the code as those components evolve.

13 years of hands-on software engineering experience including production ownership of non-trivial systemsnStrong software engineering fundamentals with proficiency in at least two: Python Go Java and comfort working across additional languages as the work requiresnSolid working knowledge of software supply chain security concepts including package and dependency risk build and release integrity artifact signing and verification attestation infrastructure and policy-based admission of software into runtime environmentsnExperience designing building and operating agentic systems and LLM-integrated applications in production including prompt engineering orchestration and evaluation of model outputsnFamiliarity with application security assurance methodologies including static and dynamic analysis approaches and their operational trade-offsnExperience designing and operating distributed backends: APIs data pipelines and services with meaningful uptime and performance requirementsnExperience building and maintaining CI/CD pipelines and integrating security controls into themnComfortable operating in Linux and macOS environments with proficiency in a shell scripting language such as BashnWorking understanding of the full software development lifecycle building testing deploying and monitoring production software

Experience building policy admission systems that enforce security controls at deployment or runtimenExperience with threat modeling taint analysis or other program-analysis techniquesnWorking knowledge of common web and service-level vulnerabilities (injection IDOR input validation authentication and authorization flaws)nExperience evaluating and integrating new models and services to extend product capabilitiesnFull-stack engineering experience including building user-facing surfaces that expose complex data to internal customersnExperience with containerization container orchestration and cloud infrastructure at scalenExperience with gRPC and other high-performance service interfacesnBachelors degree in Computer Science or equivalent work experience in a related field