We are the software supply chain security team, part of Apple Services Engineering (ASE) Security org. We work on the software behind iCloud, App Store, Apple Music, TV+, and Commerce. We build the tooling that helps Apple ship software it can trust. Our team gives engineers clear visibility into what's in their code, finds security issues before release, and keeps unsafe code out of production. Engineering teams across Apple Services rely on what we build.
Our near-term focus is assurance signal. Scanners, design reviews, and code analysis generate findings faster than anyone can evaluate them, so engineers end up triaging noise by hand and lose trust in the results. That triage step limits how much assurance we can run and how much of it partner teams act on. We are building automated security assurance that engineers can trust. It combines agentic and LLM-driven analysis with the evaluation harnesses and guardrails that keep non-deterministic components reliable as inputs, targets, and models change.
Our longer-term agenda is the software supply chain itself. Today, answering basic questions about a running service takes a person a full day of chasing down registries, build systems, and scanners: what went into this build, where each dependency came from, and who owns the fix when one goes bad. We are building the paved path that answers those questions by design, through dependency risk management, build and release integrity, artifact signing and verification, and policy-based admission of software into runtime.
Show the full description
We are looking for a Senior Software Engineer to design, write, and ship production software. Success here takes strong distributed systems engineering, real judgment about where agentic components belong and where they don’t, and the ability to make security controls show up in other teams’ existing workflows without becoming a tax.