We are the Dependency Risk & Automation Team in Apple Services Engineering (ASE) Security. We're responsible for understanding what software Apple runs, where it came from, and how exposed it is, across the internal and open-source projects behind iCloud, Music, Siri, the App Store, and the rest of Apple's services.
Composition and vulnerability signal reach us from build systems, package registries, vulnerability feeds, and SBOMs generated across a large, heterogeneous estate of projects and languages, and increasingly from dependency choices made by AI coding assistants and agents rather than the engineers who own the code. Turning that into one prioritized, trustworthy picture of risk that engineering teams can act on and security leadership can rely on takes real architectural judgment, not just tooling.
We're looking for a senior engineer to take technical ownership of significant parts of this problem: shaping how software inventory and vulnerability data are modeled and correlated, setting the engineering quality bar the rest of the platform is held to, and mentoring engineers across the team and adjacent teams on how to reason about supply chain risk. You'll make the architectural calls that determine whether the rest of the company can trust and act on that data, and you'll play a meaningful role in ensuring the highest standard of security for one of the most-watched companies in the world.
