Job description

We are looking for a Principal Engineer who will be the technical owner of what it takes to run this agent reliably on a very large fleet, and who will also keep the team shipping new capabilities quickly. You will own quality, reliability and operational excellence for the EDR. That includes the relationship with the Security SRE team, the platform-specific SRE teams, and the Tier 1, Tier 2 and Tier 3 support model that lets the agent run safely at scale. You will be a trusted owner of outcomes who can be handed an ambiguous, high-stakes problem and be expected to deliver, and to build a culture around you that learns from every failure. This role will leave a lasting impact on Apple's security posture, and by extension, the security of Apple's customers around the world. 15+ years of professional experience building, shipping and supporting production software or system software. Seniority here is defined by scope, ownership and impact, not only years. Strong hands-on experience with Swift on server, C for eBPF and kernel-level code Experience owning the reliability of a critical production system, including its availability and performance objectives, rollout safety and operational readiness. Experience leading incident response and written or led post-mortems, and has a demonstrated history of building a reliability learning culture in a team or organization (blameless reviews, follow-through on corrective actions, measurable improvement). Personal proficiency in at least one high-level or scripting language (Python or Rust) and at least one low-level systems language (C or C++). Strong knowledge of operating system internals (processes, threads, memory, system calls, namespaces). Linux, macOS or both Credible understanding of attacker behavior and security concepts, and of how malicious activity shows up in host telemetry. Ability to participate in a Tier 3 support rotation, and to lead the design of the support model for the agent. Experience developing Tier 1 and Tier 2 support runbooks and partnering with and training SREs to use them. Public contributions such as open source work, talks, papers or blog posts. Experience building or operating endpoint, host or agent software deployed at very large scale, with strict performance and availability objectives. Experience defining a tiered support and escalation model with a mix of non-developer SRE teams and development teams. Experience with eBPF, EndpointSecurity or similar OS-level instrumentation, and an understanding of how those mechanisms can be evaded or disabled. Experience with Swift on server, concurrency in Swift, and cross-platform builds. Understanding of EDR or host-based detection techniques and the current industry state of the art. Experience with policy-driven detection logic (for example OPA/Rego), and with statistical techniques such as probabilistic data structures for bounded-memory anomaly detection. Experience with virtualization and hypervisor environments.

Requirements

Must-haves

15+ years of professional experience building, shipping and supporting production software or system software. Seniority here is defined by scope, ownership and impact, not only years.
Strong hands-on experience with Swift on server, C for eBPF and kernel-level code
Experience owning the reliability of a critical production system, including its availability and performance objectives, rollout safety and operational readiness.
Personal proficiency in at least one high-level or scripting language (Python or Rust) and at least one low-level systems language (C or C++).
Strong knowledge of operating system internals (processes, threads, memory, system calls, namespaces). Linux, macOS or both
Credible understanding of attacker behavior and security concepts, and of how malicious activity shows up in host telemetry.
Ability to participate in a Tier 3 support rotation, and to lead the design of the support model for the agent.
Experience developing Tier 1 and Tier 2 support runbooks and partnering with and training SREs to use them.
Public contributions such as open source work, talks, papers or blog posts.
Experience building or operating endpoint, host or agent software deployed at very large scale, with strict performance and availability objectives.
Experience defining a tiered support and escalation model with a mix of non-developer SRE teams and development teams.
Experience with eBPF, EndpointSecurity or similar OS-level instrumentation, and an understanding of how those mechanisms can be evaded or disabled.
Experience with Swift on server, concurrency in Swift, and cross-platform builds.
Understanding of EDR or host-based detection techniques and the current industry state of the art.
Experience with policy-driven detection logic (for example OPA/Rego), and with statistical techniques such as probabilistic data structures for bounded-memory anomaly detection.
Experience with virtualization and hypervisor environments.

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

swiftpythonrust

Platform: apple
Effort: medium