Job description

This role owns technical depth across software composition analysis, vulnerability intelligence, and the automation that keeps both operating reliably at Apple's scale. You'll work across a diverse set of tools and codebases, and you'll be one of the people other engineers and adjacent security teams turn to when supply chain risk questions get hard, from how we track what's in our software, to how we correlate that against emerging vulnerabilities and end-of-life risk, to how we make that information actionable rather than just available. You will confront a new class of problem, as AI coding assistants and agents generate a growing share of Apple's code and a growing share of its dependency choices you'll help define what secure software development means when dependencies increasingly get pulled in with minimal human review. 8+ years of experience in security software engineering, with demonstrated end-to-end ownership of a system or platform, and hands-on experience in the software supply chain security, dependency management and OSS risk Deep proficiency in Go and strong proficiency in Java, including both languages' dependency ecosystems (Go Modules, Maven/Gradle), plus solid software engineering fundamentals Experience with SBOM standards, software composition analysis (SCA) tooling and vulnerability data sources (e.g., NVD, OSV, GitHub Advisories), turning raw feeds into prioritized signal Track record of technical leadership — driving architecture decisions, setting technical direction for a team or platform, mentoring other engineers, and communicating technical tradeoffs clearly to both engineers and security leadership Experience with software delivery pipelines (CI/CD, build systems, release engineering) and cloud/container infrastructure (Kubernetes, AWS or equivalent) Practical, hands-on experience with AI coding assistants or agentic development tools, and an understanding of emerging AI-specific supply chain risks Familiarity with specific SBOM formats and tooling (CycloneDX, SPDX, cdxgen, syft) and the Package URL (purl) standard Knowledge of Open Container Initiative (OCI) image concepts Experience with SLSA (Supply-chain Levels for Software Artifacts) and build/artifact attestations Experience with graph-based data modeling for dependency or risk relationships Experience designing or operating automated dependency curation or allow-listing systems that can keep pace with AI-accelerated development Familiarity with spec-driven development workflows and how they change the security review surface

Requirements

Must-haves

8+ years of experience in security software engineering, with demonstrated end-to-end ownership of a system or platform, and hands-on experience in the software supply chain security, dependency management and OSS risk
Deep proficiency in Go and strong proficiency in Java, including both languages' dependency ecosystems (Go Modules, Maven/Gradle), plus solid software engineering fundamentals
Experience with SBOM standards, software composition analysis (SCA) tooling and vulnerability data sources (e.g., NVD, OSV, GitHub Advisories), turning raw feeds into prioritized signal
Experience with software delivery pipelines (CI/CD, build systems, release engineering) and cloud/container infrastructure (Kubernetes, AWS or equivalent)
Practical, hands-on experience with AI coding assistants or agentic development tools, and an understanding of emerging AI-specific supply chain risks
Familiarity with specific SBOM formats and tooling (CycloneDX, SPDX, cdxgen, syft) and the Package URL (purl) standard
Knowledge of Open Container Initiative (OCI) image concepts
Experience with SLSA (Supply-chain Levels for Software Artifacts) and build/artifact attestations
Experience with graph-based data modeling for dependency or risk relationships
Experience designing or operating automated dependency curation or allow-listing systems that can keep pace with AI-accelerated development
Familiarity with spec-driven development workflows and how they change the security review surface

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aigojavaci/cdkubernetesaws

Platform: apple
Effort: medium