Sr Security Operations (SecOps) Engineer
Apple · Austin
- Sr Security Operations (SecOps) Engineer
- Austin, Texas, United States
- Software and Services
- Submit Resume
- Summary
- Posted:
- Oct 29, 2026
- Role Number:
- 200692524-0157
- We are looking for an experienced Senior Security Operations (SecOps) Engineer to help define and drive the security strategy for applications, cloud infrastructure, and engineering platforms. We are particularly interested in a hands-on engineer who can build and integrate reusable security platforms, automation, and intelligent controls that make security proactive and scalable as software and AI-enabled systems evolve. You will serve as a senior technical security partner to application engineering, DevOps, Site Reliability Engineering, platform engineering, and Apple Information Security teams.
- Sales and Operations Engineering is part of IS&T and drives the technology behind Apple's global operations, sales, and supply chain. The team connects the systems that move products from factory to customer — bridging sales platforms with the operational infrastructure that keeps Apple running at scale and ensuring Apple's technology and business priorities move in lockstep.
- Description
- In this role, you will lead complex security assessments and threat modeling, define scalable security controls, influence application and infrastructure architecture, and develop automation that enables security to be embedded throughout the software development lifecycle. You will identify systemic security risks and create engineering solutions that improve security across multiple applications and teams rather than relying on manual or application-specific controls. You will connect security signals to application ownership, business context, and engineering workflows so that teams can prioritize and remediate the risks that matter most.
- You will combine deep security expertise with software, cloud, and infrastructure engineering experience to help teams design and operate secure systems at scale. You will also evaluate how AI-assisted and agentic workflows can responsibly improve security analysis, detection, triage, and remediation, while helping teams manage the new risks introduced by AI-enabled applications and agents.
- Responsibilities
- Lead security architecture reviews, threat modeling, and risk assessments for complex applications, platforms, cloud environments, and distributed systems.
- Serve as a senior technical security advisor to application engineering, DevOps, SRE, platform engineering, and leadership teams.
- Define security architecture patterns, engineering standards, reusable controls, and guardrails that can be adopted across multiple engineering organizations.
- Identify security enforcement points across CI/CD pipelines, infrastructure-as-code, cloud platforms, Kubernetes, APIs, and application architectures.
- Design and drive scalable DevSecOps capabilities including SAST, DAST, software composition analysis, container security, secrets scanning, supply-chain security, and policy enforcement.
- Lead vulnerability management strategy including discovery, risk prioritization, remediation guidance, exception management, and executive-level reporting. Where practical, correlate findings with exploitability, asset exposure, application criticality, and ownership to support actionable prioritization.
- Partner with designated incident-response and Information Security teams on significant security incidents, partnering with engineering and Information Security teams on containment, remediation, root cause analysis, and preventative controls.
- Develop or guide development of security tooling, automation, and services using Python, Go, APIs, infrastructure-as-code, or similar technologies. Own hands-on implementation of selected integrations and production-quality security automation, not solely advisory design.
- Identify opportunities to replace manual security processes with automated controls and self-service security capabilities.
- Evaluate security architecture for AWS/GCP services, Kubernetes platforms, containerized workloads, networking, IAM, secrets management, and multi-tenant systems.
- Partner with engineering teams early in product and system design to identify risks before deployment rather than relying primarily on post-production detection.
- Establish security metrics and risk indicators that provide leadership visibility into application and infrastructure security posture. Emphasize coverage, time to remediate critical exposures, control effectiveness, and measurable risk reduction—not just raw vulnerability counts.
- Evaluate new security technologies and lead technical proofs of concept and adoption decisions. Favor interoperability and maintainability over introducing isolated tools.
- Mentor engineers and raise security engineering expertise across SecOps, DevOps, SRE, and application engineering teams.
- Influence security direction across organizational boundaries without requiring direct management authority.
- Design, prototype, and selectively integrate AI-assisted or agentic capabilities for vulnerability analysis, security reviews, incident investigation, and remediation recommendations. Evaluate accuracy and operational value, with least-privilege access, auditability, and human approval for consequential actions.
- Build integrations across source control, CI/CD, security scanners, asset inventories, observability, and engineering ticketing systems to turn fragmented findings into actionable workflows.
- Help assess AI/LLM application and agent risks, including prompt injection, untrusted tool outputs, sensitive-data exposure, and excessive permissions, in collaboration with Information Security and application teams.
- Minimum Qualifications
- 8+ years of experience in security engineering, application security, cloud security, DevSecOps, infrastructure security, security operations, or a related engineering discipline.
- 8+ years of experience leading security reviews, threat modeling, risk assessments, and r