Principal Security Software Engineer, EDR

Summary

The Detection team within Apple Services Engineering (ASE) is responsible for finding any threat actors attacking approximately three quarters of Apple's systems and services. We do this by partnering closely with engineering teams to build a deep technical understanding of how their systems work, and a comprehensive understanding of the threats against them.

A growing part of that mission is the endpoint detection and response (EDR) technology we build ourselves. It is a Swift-based agent that runs on Linux (x86 and ARM64) and on Apple operating systems running on Apple silicon. It collects security telemetry, evaluates detections directly on the host, and takes response action on the host.

It also supports Apple's Private Cloud Compute (PCC), the system that extends the privacy and security of Apple devices into the cloud and runs the larger models behind Apple Intelligence. Most of your work will be on Apple's own internal servers, and some of it supports public-facing products used by hundreds of millions of people.

About the role

We are looking for a Principal Engineer who will be the technical owner of what it takes to run this agent reliably on a very large fleet, and who will also keep the team shipping new capabilities quickly. You will own quality, reliability and operational excellence for the EDR.

That includes the relationship with the Security SRE team, the platform-specific SRE teams, and the Tier 1, Tier 2 and Tier 3 support model that lets the agent run safely at scale. You will be a trusted owner of outcomes who can be handed an ambiguous, high-stakes problem and be expected to deliver, and to build a culture around you that learns from every failure.

This role will leave a lasting impact on Apple's security posture, and by extension, the security of Apple's customers around the world.

Minimum Qualifications

• 15+ years of professional experience building, shipping and supporting production software or system software. Seniority here is defined by scope, ownership and impact, not only years.
• Strong hands-on experience with Swift on server, C for eBPF and kernel-level code
• Experience owning the reliability of a critical production system, including its availability and performance objectives, rollout safety and operational readiness.
• Experience leading incident response and written or led post-mortems, and has a demonstrated history of building a reliability learning culture in a team or organization (blameless reviews, follow-through on corrective actions, measurable improvement).
• Personal proficiency in at least one high-level or scripting language (Python or Rust) and at least one low-level systems language (C or C++).
• Strong knowledge of operating system internals (processes, threads, memory, system calls, namespaces). Linux, macOS or both
• Credible understanding of attacker behavior and security concepts, and of how malicious activity shows up in host telemetry.

Preferred Qualifications

• Ability to participate in a Tier 3 support rotation, and to lead the design of the support model for the agent.
• Experience developing Tier 1 and Tier 2 support runbooks and partnering with and training SREs to use them.
• Public contributions such as open source work, talks, papers or blog posts.
• Experience building or operating endpoint, host or agent software deployed at very large scale, with strict performance and availability objectives.
• Experience defining a tiered support and escalation model with a mix of non-developer SRE teams and development teams.
• Experience with eBPF, EndpointSecurity or similar OS-level instrumentation, and an understanding of how those mechanisms can be evaded or disabled.
• Experience with Swift on server, concurrency in Swift, and cross-platform builds.
• Understanding of EDR or host-based detection techniques and the current industry state of the art.
• Experience with policy-driven detection logic (for example OPA/Rego), and with statistical techniques such as probabilistic data structures for bounded-memory anomaly detection.
• Experience with virtualization and hypervisor environments.