Senior Security Software Engineer, Datacenter Infrastructure Security

Responsibilities

You will own the design, code, and security of a privileged, availability-critical service managing baseboard management controllers. You will also lead the modernization of fleet management and define secure out-of-band management standards at Apple.

Requirements

Candidates must have 8+ years of software engineering experience with deep proficiency in Go and experience in security telemetry. A background in authentication, authorization, and familiarity with server management technologies like IPMI or Redfish is required.

Skills

• Go
• Swift
• Rust
• Security Engineering
• PKI
• mTLS
• X.509
• Telemetry
• Splunk
• OpenTelemetry
• IPMI
• DMTF Redfish
• OpenBMC
• gRPC
• Protocol Buffers
• PostgreSQL

About this role

We are the Foundational Security team in Apple Services Engineering (ASE). We
secure the low-level foundations of Apple's datacenter fleet: hardware-backed
trust, disk encryption, and the systems used to manage every server below the
operating system. We're looking for a senior engineer to take technical
ownership of the platform that manages our baseboard management controllers.
You'll set its engineering and security bar, shape how access is granted and
verified, and lead its move toward modern, standards-based management. You'll
work closely with datacenter operations, SRE, hardware, network and detection
teams, and become the go-to expert on managing Apple's fleet securely.

DESCRIPTION

This role owns the design, code and security of a privileged,
availability-critical service. You'll write and review production code. You'll
find and remove risk in how the service authenticates users, authorizes them and
handles credentials, and you'll make privileged activity visible to the teams
who detect misuse. You'll also help modernize how the fleet is managed, bringing
along the many internal teams and tools that depend on the platform. Over time,
you'll help define what secure out-of-band management looks like at Apple. That
includes how access is segmented across environments, how firmware is delivered
and trusted, and what we require of management controllers in future hardware.
It also includes how access should work when the requester is an automated
system rather than a person.

MINIMUM QUALIFICATIONS

8+ years of software engineering experience, including end-to-end ownership of a
production system or platform Deep proficiency in Go, with 5+ years writing
production Go code. Experience building security telemetry for SIEM and
detection pipelines (e.g., Splunk, OpenTelemetry) Hands-on experience with
authentication and authorization at scale, including PKI, mTLS, X.509
certificate identity and fine-grained access control Experience with Swift, and
Rust BS/MS in Computer Science or equivalent experience

PREFERRED QUALIFICATIONS

Hands-on experience with server management technologies such as IPMI, DMTF
Redfish, OpenBMC, or vendor BMCs (e.g., HPE iLO, Dell iDRAC) Experience finding
and fixing security flaws in networked services through code review, threat
modeling or security testing A track record of technical leadership: driving
architecture decisions and cross-team migrations, mentoring engineers, and
explaining security trade-offs to engineers and leadership Experience with gRPC
and Protocol Buffers, and with running PostgreSQL in production Experience
managing the lifecycle of secrets and credentials at fleet scale, including
rotation and emergency access Experience building and operating highly
available, distributed services that other teams depend on Familiarity with
network segmentation and zero-trust access patterns, such as identity-aware
proxies Knowledge of firmware security, including secure boot, firmware signing
and updates, TPMs and hardware roots of trust Hands-on experience using AI
coding assistants on a production codebase

About Apple

Computers and Electronics Manufacturing · 10,001+ employees · headquartered in Cupertino, California · founded 1976