{"id":2973057,"url":"https://alion.io/job/apple-principal-security-software-engineer-edr","title":"Principal Security Software Engineer, EDR","company":{"id":12,"name":"Apple","domain":"apple.com","url":"https://alion.io/company/apple","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Apple Jobs","truth_index":{"grade":"A","score":91,"open_postings":931,"ghost_share":0,"stale_share":0.15,"repost_share":0.002,"time_to_fill_p50_days":102,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Seattle, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":222000,"max_usd":460000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":398},"experience_years_min":15,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"C++","optional":false},{"name":"eBPF","optional":false},{"name":"Linux","optional":false},{"name":"Python","optional":false},{"name":"Rust","optional":false}],"status":"live","first_seen_at":"2026-10-21T02:00:39Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-10-23T09:00:54Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"The Detection team within Apple Services Engineering (ASE) is responsible for finding any threat actors attacking approximately three quarters of Apple's systems and services. We do this by partnering closely with engineering teams to build a deep technical understanding of how their systems work, and a comprehensive understanding of the threats against them.\nA growing part of that mission is the endpoint detection and response (EDR) technology we build ourselves. It is a Swift-based agent that runs on Linux (x86 and ARM64) and on Apple operating systems running on Apple silicon. It collects security telemetry, evaluates detections directly on the host, and takes response action on the host. It also supports Apple's Private Cloud Compute (PCC), the system that extends the privacy and security of Apple devices into the cloud and runs the larger models behind Apple Intelligence. Most of your work will be on Apple's own internal servers, and some of it supports public-facing products used by hundreds of millions of people.\nDescription\nWe are looking for a Principal Engineer who will be the technical owner of what it takes to run this agent reliably on a very large fleet, and who will also keep the team shipping new capabilities quickly. You will own quality, reliability and operational excellence for the EDR. That includes the relationship with the Security SRE team, the platform-specific SRE teams, and the Tier 1, Tier 2 and Tier 3 support model that lets the agent run safely at scale. You will be a trusted owner of outcomes who can be handed an ambiguous, high-stakes problem and be expected to deliver, and to build a culture around you that learns from every failure. This role will leave a lasting impact on Apple's security posture, and by extension, the security of Apple's customers around the world.\nMinimum Qualifications\n15+ years of professional experience building, shipping and supporting production software or system software. Seniority here is defined by scope, ownership and impact, not only years.\nStrong hands-on experience with Swift on server, C for eBPF and kernel-level code\nExperience owning the reliability of a critical production system, including its availability and performance objectives, rollout safety and operational readiness.\nExperience leading incident response and written or led post-mortems, and has a demonstrated history of building a reliability learning culture in a team or organization (blameless reviews, follow-through on corrective actions, measurable improvement).\nPersonal proficiency in at least one high-level or scripting language (Python or Rust) and at least one low-level systems language (C or C++).\nStrong knowledge of operating system internals (processes, threads, memory, system calls, namespaces). Linux, macOS or both\nCredible understanding of attacker behavior and security concepts, and of how malicious activity shows up in host telemetry.\nPreferred Qualifications\nAbility to participate in a Tier 3 support rotation, and to lead the design of the support model for the agent.\nExperience developing Tier 1 and Tier 2 support runbooks and partnering with and training SREs to use them.\nPublic contributions such as open source work, talks, papers or blog posts.\nExperience building or operating endpoint, host or agent software deployed at very large scale, with strict performance and availability objectives.\nExperience defining a tiered support and escalation model with a mix of non-developer SRE teams and development teams.\nExperience with eBPF, EndpointSecurity or similar OS-level instrumentation, and an understanding of how those mechanisms can be evaded or disabled.\nExperience with Swift on server, concurrency in Swift, and cross-platform builds.\nUnderstanding of EDR or host-based detection techniques and the current industry state of the art.\nExperience with policy-driven detection logic (for example OPA/Rego), and with statistical techniques such as probabilistic data structures for bounded-memory anomaly detection.\nExperience with virtualization and hypervisor environments.","description_format":"text","description_chars":4086,"description_truncated":false,"requirements":{"experience_years_min":15,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Operating Systems","Laptops","Smartwatches & Fitness Trackers","Tablets"],"lifecycle":[{"event":"open","at":"2026-10-21T03:16:03Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 6,350 · green card filings: 37","filings_12m":6350,"filings_prev_12m":6527,"green_card_filings_12m":37,"median_offered_wage_usd":177355,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":276}],"liveness":{"score":99,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.993,"p_room":1,"age_days":2,"expected_fill_days":102,"reasons":["conf:1","urgency","velocity","win:early","comp:brand"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/apple-principal-security-software-engineer-edr","json_url":"https://alion.io/job/apple-principal-security-software-engineer-edr.json","meta":{"generated_at":"2026-10-23T11:18:44Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":17156,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":12},"rest":"https://alion.io/mcp/rest/get_company?id=12"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fapple-principal-security-software-engineer-edr"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fapple-principal-security-software-engineer-edr"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fapple-principal-security-software-engineer-edr"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/apple-principal-security-software-engineer-edr\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fapple-principal-security-software-engineer-edr"}]}