{"id":3476478,"url":"https://alion.io/job/apple-sr-security-incident-response-engineer-ais","title":"Sr Security Incident Response Engineer, AIS","company":{"id":12,"name":"Apple","domain":"apple.com","url":"https://alion.io/company/apple","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Apple Jobs","truth_index":{"grade":"A","score":91,"open_postings":860,"ghost_share":0,"stale_share":0.171,"repost_share":0.002,"time_to_fill_p50_days":96,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Austin, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":181000,"max_usd":346000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1385},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":true},{"name":"Threat Modeling","optional":true}],"status":"live","first_seen_at":"2026-10-29T18:29:09Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-11-01T00:09:31Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Imagine what you could do here. At Apple, new ideas have a way of becoming extraordinary products, services, and customer experiences very quickly.\nApple Information Security is looking for an experienced Incident Response engineer to help protect Apple, our customers, and our data. This is work where the stakes are real, the scope is global and the decisions you make during an incident shape outcomes across the company.\nWe're a diverse collection of thinkers and doers who are continually reimagining how threats get identified, contained, and mitigated. You'll bring deep technical judgment, the instinct to anticipate an attacker's next move rather than only recognize the last one, and work with other responders to build a stronger team. This is a deeply collaborative role where operations, critical thinking, and technology converge, and where you'll be trusted to own hard calls and build the capabilities the team relies for handling complex security incidents.\nBring your passion and dedication to this job, and there's no telling what you could accomplish.\nDescription\nApple Information Security is seeking a senior security professional to join its Incident Response team. The successful candidate brings a proven technical background and substantial Information Security experience, with deep focus across the incident response lifecycle.\nYou'll work with a global team of security professionals on a follow-the-sun model, focused primarily on the identification, containment, and mitigation of security incidents. You'll be trusted to drive complex, ambiguous investigations to resolution with minimal guidance, to set the bar for investigative quality, and to up-level the team around you. You'll also help move the function forward, turning what you learn in one investigation into durable capability the whole team benefits from. This person will have the opportunity to work on technology and processes with global reach.\nMinimum Qualifications\nB.S. in Computer Science, Engineering, or similar degree and/or equivalent 5+ years of experience in Information Security with a focus on Incident Response, Security Engineering, and/or Intrusion Detection, including significant hands-on response work\nDemonstrated ability to drive investigations independently - comfortable testing hypotheses, establishing root cause, and applying policy and remediation strategies\nDemonstrated experience mentoring and coaching other responders, sharing expertise in a way that measurably improves the work of those around you\nStrong understanding of incident response automation strategies, with a track record of implementing them\nProficiency in one or more programming or scripting languages\nPreferred Qualifications\nProven ownership of complex, ambiguous problems through to resolution, with sound judgment about what to decide and when to escalate\nStrong understanding of threat modeling, operational threat intelligence, and common attack vectors\nStrong understanding on AI to apply innovation into IR processes through controlled, replicable and traceable strategies.\nDeep working knowledge of modern identity management, with the ability to reason about and determine blast radius within an incident\nPractical understanding of attacker tradecraft sufficient to anticipate the next step rather than only recognize the last one\nHas repeatedly turned a one-off investigation into durable capability - a detection, a query, a reusable process\nCuriosity about emerging attack surfaces and vectors\nFluency analyzing large-scale datasets, context-switching between data sources, and working directly with raw telemetry during investigations\nWorking competence across several of: endpoint/OS internals, cloud control planes, SaaS platforms, corporate IT infrastructure, and developer/CI-CD environments\nExperience in malware analysis, digital forensics, intrusion detection, and/or threat intelligence\nTechnical certifications are a plus (OSCP, GIAC, CCNP/CCIE, and similar)\nExcellent verbal and written communication skills, including the ability to brief audiences with varying levels of technical context","description_format":"text","description_chars":4110,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Operating Systems","Smartwatches & Fitness Trackers","Tablets"],"lifecycle":[{"event":"open","at":"2026-10-29T18:52:12Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 6,350 · green card filings: 37","filings_12m":6350,"filings_prev_12m":6527,"green_card_filings_12m":37,"median_offered_wage_usd":177355,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":276}],"liveness":{"score":99,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.993,"p_room":1,"age_days":1,"expected_fill_days":96,"reasons":["conf:0","urgency","velocity","win:early","comp:brand"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/apple-sr-security-incident-response-engineer-ais","json_url":"https://alion.io/job/apple-sr-security-incident-response-engineer-ais.json","meta":{"generated_at":"2026-11-01T02:09:43Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3234,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":12},"rest":"https://alion.io/mcp/rest/get_company?id=12"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fapple-sr-security-incident-response-engineer-ais"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fapple-sr-security-incident-response-engineer-ais"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fapple-sr-security-incident-response-engineer-ais"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/apple-sr-security-incident-response-engineer-ais\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fapple-sr-security-incident-response-engineer-ais"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3476478}},{"tool":"search_jobs","arguments":{"company":"apple.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3476478},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}