Senior Security Software Engineer EDR

Responsibilities

• Build and scale Apple’s endpoint detection and response agent for a large fleet.
• Collect security telemetry, evaluate detections on hosts, and take response actions on hosts.
• Develop production software for Linux and Apple operating systems running on Apple silicon.
• Translate ambiguous, high-stakes security problems into working software in partnership with other engineering teams.
• Build CI/CD and release tooling with staged rollout and rollback capabilities for host-deployed software.
• Maintain high performance, availability, and reliability without taking production systems down.

Requirements

• 7+ years of professional experience building, shipping, and supporting production software or system software.
• Proficiency in at least one high-level or scripting language, such as Python or Rust, and at least one low-level systems language, such as C or C++.
• Solid knowledge of operating system internals, including processes, threads, memory, system calls, and namespaces, on Linux, macOS, or both.
• Understanding of attacker behavior, security concepts, and how malicious activity appears in process, network, and file telemetry.
• Preferred experience with endpoint, host, or agent software deployed at large scale with performance and availability objectives.
• Preferred experience with eBPF, EndpointSecurity, or similar OS-level instrumentation and knowledge of how those mechanisms can be evaded or disabled.
• Preferred experience with Swift on server, Swift concurrency, and cross-platform builds.
• Preferred understanding of EDR or host-based detection techniques and current industry practices.
• Preferred experience with policy-driven detection logic such as OPA/Rego and statistical techniques such as probabilistic data structures for bounded-memory anomaly detection.
• Preferred experience with virtualization and hypervisor environments.