Senior Software Engineer - Security Automation

People at Apple dont just build products - they craft the kind of experiences that have revolutionized entire industries. The diverse collection of our people and their ideas inspire innovation in everything we do. Imagine what you could do here! Join Apple, and help us leave the world better than we found it.

The Apple Services Engineering Security team builds and provides secure systems and infrastructure that fuel Apples services (such as iCloud, iTunes, Siri, App Store, and Maps). As part of the ASE Security team, you will help manage the security needs of Apples services around the world. You will build and integrate the security controls, guardrails, and frameworks that help protect our customers data in Apples infrastructure.

We are ASE Security Automation. We build the tools, systems, and services that automate security assurance across Apples services: agentic vulnerability and rapid risk assessment, design review tooling, and the registers of security-critical applications, data, and environments that security teams rely on, We build automation capabilities, and the tools other security teams run today, under one roof: risk-scoring pipelines, compliance workflows, and an agentic risk-assessment layer.

We are hiring a Staff/Senior Software Engineer who can build, support, refactor, and ship across all of it.

Were looking for a versatile senior software engineer who moves between our systems based on organizational priority and makes each one better for having worked on it. One quarter you may be implementing a critical service on the new platform; the next, refactoring a legacy tool that security reviewers depend on daily, or preparing a system for production so it runs with low friction and low maintenance.

You will work with our Tech Leads and hiring manager on technical direction, then independently own the delivery of the critical components you take on - from design through production. You will set the bar for how our systems are built to run well in production, and you will mentor engineers and influence their technical solutions along the way. Implement critical parts of our systems end to end: backend services in Python, Go, or Java; the web frontends (TypeScript/React) that security reviewers and analysts use; the data models that define security and risk findings; and the cloud infrastructure and IaC they run on. Move between systems based on organizational priority: the Security Automation Platform (risk-scoring pipelines, compliance workflows, the agentic risk-assessment layer) and our existing systems (agentic vulnerability and rapid risk assessment, design review tools, registers of security-critical applications, data, and environments). Build new services from scratch when that is the right call - and integrate with existing security tooling when it isnt. Support and maintain the legacy systems our partners depend on today, and keep them healthy while they serve customers. Refactor and migrate legacy systems into new ones incrementally, without disrupting the teams that rely on them. Make deliberate refactor-versus-rebuild calls and explain the trade-off. Onboard existing tools onto the platform as building blocks, so their owners focus on their core logic rather than on data, storage, and UI plumbing. Pay down technical debt deliberately, leaving each system easier to change than you found it. Build systems that are low friction and low maintenance to run: fast development and iteration, fast and safe deployment, and robust production operation. Establish the delivery foundations: staged deployments, test environments, automated testing, observability, and runbooks. Prepare systems for production operation: define readiness criteria, service level objectives, and rollback paths before a system takes real traffic. Raise these practices to team standards that other engineers follow and build on. Align with the Tech Lead and hiring manager on technical direction, then own the delivery of your components independently. Mentor engineers and influence their technical solutions through design reviews, code reviews, and pairing. Partner with security engineers, analysts, and tool owners to understand what they need and deliver software they trust. Research, prototype, and present ideas and designs to your team, management, and internal customers.

8+ years building, operating, and maintaining production software - backend services, automation Highly proficient in at least one of Python, Go, or Java Experience building production web frontends with TypeScript and React Hands-on experience with cloud infrastructure, containers and Kubernetes, CI/CD, and infrastructure as code Experience supporting and maintaining legacy systems in production, refactoring or migrating them into new systems, and building new systems from scratch Track record of building systems for operational excellence: staged deployments, test environments, automated testing, and observability Experience integrating first-party and third-party APIs, tools, and services into reliable end-to-end workflows MS or BS or equivalent experience in Computer Science, Engineering, or a related field OR equivalent practical experience in Software or Security Engineering.Production experience in more than one of Python, Go, or Java Working knowledge of application and cloud security concepts (threat modeling, vulnerabilities, secure configuration) Experience with security tooling such as SAST/SCA scanners, SBOM tooling, or vulnerability intelligence platforms Experience building LLM- or agent-based features, integrating agents with existing systems (tool calling, MCP), or evaluating AI output quality Familiarity with AWS cloud resources (S3, EC2, Lambda, Step Functions, etc.) Experience building batch or streaming data pipelines Experience with Swift or mobile development Experience delivering tooling used by non-engineer users such as security reviewers or analysts Track record of mentoring engineers and raising engineering practices beyond your own work