Staff Security Engineer - AI-Driven Security Assurance

Apple Services Engineering (ASE), the team behind iCloud and Media services and the infrastructure that powers them, is looking for a Senior Security Engineer to partner with engineering teams to build AI-driven security assurance capabilities. You will collaborate with developers, site reliability engineers, and security teams to protect ASE services and design a secure foundation for services at Apple. Your work will include scaling assurance activities, including security risk assessments, threat modeling, and development of security standards. You will work with partner teams in security engineering, privacy, and offensive security to keep Apple's services secure for our users. If you love diving into complex technical systems, sharing security improvements, and making security better, we want to hear from you!

In this role, you will combine deep expertise in security architecture, threat modeling, security design review, and spec-driven development (SDD) with hands-on experience building sophisticated AI-powered systems. You will design and develop intelligent security assurance capabilities that leverage large language models, autonomous agents, and build organization–specific security context to identify and prevent meaningful security risk across complex systems and architectures.

You will also help define how security is incorporated into SDD practices, ensuring that security requirements, threat models, abuse cases, trust boundaries, controls, and verification criteria are established early and carried through the specification, implementation, testing, and development lifecycle.

This is a hands-on engineering role at the intersection of security assurance and applied-AI. You will partner closely with software engineers, architects, and product teams working at the forefront of agent technology, to understand emerging capabilities, influence how agentic systems are designed and developed, and integrate security throughout the software development lifecycle (SDLC).

Minimum Qualifications

• 10 or more years of hands-on experience in security assurance, with demonstrated depth in security architecture, threat modeling, security design reviews, and security risk assessment.
• Experience evaluating AI system performance, including reliability, correctness, failure, modes, and effectiveness against defined objectives.
• Proficiency in Python or a comparable programming language, API integration, and production software development.
• Experience with LLM orchestration, agent tool use, retrieval systems, context engineering, and techniques for grounding AI outputs in trusted organizational data.
• Experience incorporating security into spec-driven development, requirements engineering, secure design practices, or comparable structured software development methodologies.

Preferred Qualifications

• Bachelor's degree or equivalent experience preferred
• Experience applying generative AI or agentic automation specific to security assurance, threat, modeling, architecture, reviews, vulnerability analysis, or spec-driven development.
• Experience building enterprise knowledge systems using RAG, knowledge graphs, persistent memory, or hybrid retrieval techniques.
• Experience in integrating AI agents with engineering tools, source code, repositories, architecture, documentation, specifications, requirements systems, and security assessment workflows.
• Experience establishing traceability between specifications, security requirements, implementation artifacts, tests, and assurance evidence.