Principal Security Software Engineer, EDR
Core
Technical owner of Apple's internal Swift-based Endpoint Detection and Response (EDR) agent, ensuring reliability, operational excellence, and rapid capability shipping for a fleet of hundreds of millions of devices.
Role type
Principal Security Software Engineer (EDR)
Builds
Swift-based EDR agent running on Linux and Apple silicon, supporting Apple's Private Cloud Compute (PCC) and Apple Intelligence.
Domain
Cybersecurity, Endpoint Security, Systems Programming
Deliverable
production ML models
Required skills
Swift (server/concurrency), C (eBPF/kernel), Linux/macOS internals, incident response, attacker behavior analysis, policy-driven detection logic, statistical anomaly detection, virtualization/hypervisor environments
Preferred skills
Tier 3 support leadership, support runbook design, open source contributions, eBPF evasion understanding, OPA/Rego, probabilistic data structures
Technologies
Swift, C, Linux, macOS, eBPF, OPA/Rego, PCC, Apple Intelligence
Responsibilities
Own quality, reliability, and operational excellence for the EDR agent; manage relationships with Security SRE and platform-specific SRE teams; lead incident response and post-mortems; design tiered support and escalation models; build a culture of reliability learning from failures.
Seniority
Principal, technical ownership & high-stakes delivery
