Senior Detection Creation Engineer

As a Detection Creation Engineer on the ASE Detection Team, you will:

Develop security detections that identify active malicious activity across Apple’s services and infrastructure, implementing detection logic in Scala Spark (Databricks) and on-host detection frameworks (Falco rules)

Analyze attacker behaviors and translate them into observable patterns across diverse telemetry sources including system call events, network logs, database access logs, endpoint security telemetry, Kubernetes audit logs, and other security-relevant data sources

Collaborate with engineering teams to understand system architectures, identify detection opportunities, and develop detections that are both high-fidelity and operationally sustainable

Tune and optimize detections based on real-world alert data, reducing false positives while maintaining coverage of malicious behaviors

Operationalize detections by working with security operations teams to ensure alerts are actionable, triaged efficiently, and integrated into incident response workflows

Document detection logic and rationale to enable knowledge sharing across the security organization

5+ years of experience in security detection, threat hunting, incident response, penetration testing, red teaming, or related security disciplines
Demonstrated understanding of real attacker behaviors, tactics, and techniques
Proficiency in at least one programming language (Python, Scala, Java, Go, or similar) with the ability and willingness to learn Scala
Bachelor’s degree in Computer Science, Cybersecurity, Engineering, Information Systems, or related field, or equivalent professional experience
Experience analyzing security telemetry data to identify malicious activity or anomalous behaviors

Prior experience writing detections in Scala, Python, or other languages for large-scale data processing systems
Experience with Apache Spark, Databricks, or similar large-scale distributed compute frameworks
Hands-on experience with on-host detection rules engine systems (Falco or similar)
Deep technical expertise in one or more areas: Linux system internals, network protocols, web application security, container/Kubernetes security, or cloud infrastructure
Experience with multiple security-relevant telemetry sources: system call traces (network, process, file), endpoint detection and response (EDR) data, network traffic analysis, application logs, database audit logs, cloud provider audit logs
Understanding of evasion techniques and how attackers attempt to avoid detection
Contributions to open-source security projects or published research on detection techniques
Experience with detection engineering at scale, including managing false positive rates and detection tuning methodologies

The people here at Apple don’t just craft products — they build the kind of wonder that revolutionizes entire industries. It’s the diversity of those people and their ideas that inspires the innovation that runs through everything we do, including our approach to security. Join Apple, and help us protect the services that billions of customers rely on every day.

The Detection team within Apple Services Engineering (ASE) is responsible for building advanced detections that protect approximately three-quarters of Apple’s systems and services. We achieve this by partnering closely with engineering teams to develop a deep technical understanding of how these systems operate, along with a comprehensive grasp of the threat landscape. This allows us to build state-of-the-art security detections that proactively defend against real-world attacks.

We’re looking for a Detection Creation Engineer who combines deep security intuition with technical implementation skills. In this role, you’ll craft detection logic that catches active malicious activity across Apple’s infrastructure. You’ll need to think like an attacker, understand how malicious behaviors manifest in telemetry data, and translate that knowledge into high-fidelity detections that protect our customers.

This is a hands-on technical role where you’ll write detection code in Scala Spark (Databricks notebooks) and configuration files for on-host detection systems (such as Falco rules). While we don’t require prior Scala experience, we do expect strong programming fundamentals and the curiosity to dive deep into new technologies.

If you’re passionate about understanding attacker tradecraft and translating that knowledge into defensive capabilities, we’d love to hear from you!

At Apple, base pay is one part of our total compensation package and is determined within a range. This provides the opportunity to progress as you grow and develop within a role. The base pay range for this role is between $171,600 and $302,200, and your base pay will depend on your skills, qualifications, experience, and location.

Apple employees also have the opportunity to become an Apple shareholder through participation in Apple’s discretionary employee stock programs. Apple employees are eligible for discretionary restricted stock unit awards, and can purchase Apple stock at a discount if voluntarily participating in Apple’s Employee Stock Purchase Plan. You’ll also receive benefits including: Comprehensive medical and dental coverage, retirement benefits, a range of discounted products and free services, and for formal education related to advancing your career at Apple, reimbursement for certain educational expenses — including tuition. Additionally, this role might be eligible for discretionary bonuses or commission payments as well as relocation. Learn more about Apple Benefits

Note: Apple benefit, compensation and employee stock programs are subject to eligibility requirements and other terms of the applicable plan or program.

Apple is an equal opportunity employer that is committed to inclusion and diversity. We seek to promote equal opportunity for all applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, Veteran status, or other legally protected characteristics. Learn more about your EEO rights as an applicant

At Apple, we believe accessibility is a fundamental human right. You’ll find that idea reflected in everything here — in our culture, our benefits and our digital tools. By welcoming as many perspectives as possible, we help you build a career where you feel like you belong.

Learn about accessibility in Apple’s workplace

Learn about reasonable accommodations for job applicants

Apple accepts applications to this posting on an ongoing basis.