About this role
About the Role
Uber's Tech Risk and Assurance team, part of Engineering Security, helps Uber understand its cybersecurity risk, decide what to do about it, and prove that controls work. Our goal is to make every experience with Uber simple, secure, and safe for riders, eaters, drivers, and partners.
As a Senior Security Technologist, GRC, you will run key parts of Uber's cyber risk management program: risk intake and assessment, risk treatment and acceptance decisions, and the reporting leaders use to see where risk sits and what has been decided. You will partner with engineering, security, audit, privacy, and compliance teams to turn control gaps, threat context, and regulatory requirements into treatment plans that engineering teams can execute, and follow those plans through to closure.
This role combines risk judgment with hands-on technical skill. You will be comfortable reading architecture and design documents, querying data, and building automation on GRC platforms and workflow tools so that risk processes scale without adding manual work. You will work within program goals set with senior leadership and own the design and delivery of the components assigned to you.
What You'll Do
- Own cyber risk intake, triage, and prioritization for your program area, so that each risk has a clear owner, a well-formed risk statement, and a timely treatment decision.
- Lead risk assessments, including annual and targeted assessments of systems, applications, and new business areas, and present results with clear recommendations.
- Run the risk exception and acceptance workflow. Confirm that requests have the right context, route them to the right approver, track conditions and expiry dates, and escalate decisions that exceed delegated authority or risk tolerance.
- Partner with engineering teams to define risk treatment plans, identify sustainable fixes, and drive mitigation to the last mile rather than stopping at documentation.
- Contribute to control design reviews and risk decisions that require judgment, stakeholder alignment, and trade-off management.
- Own the roadmap and delivery of one or more components of Uber's risk and compliance tooling. Gather requirements from partner teams, write technical specifications, and work with engineers to ship releases in an Agile delivery model.
- Configure and improve workflows on GRC platforms such as ServiceNow eGRC and Jira, including forms, business rules, client scripts, UI actions, and automation rules.
- Build automation that removes manual steps from risk workflows using Python, SQL, platform APIs, workflow tools, and approved AI tools. Examples include routing approvals, expiring acceptances, and drafting first-pass risk summaries for human review.
- Load, transform, and reconcile data between GRC platforms and other systems, and perform system and integration testing with sample and live data.
- Build and maintain risk reporting for leaders and partner teams, including KRIs, exposure trends, acceptance aging, decision status, and escalation triggers. Design dashboards and reports that support program requirements.
- Prepare material for risk governance forums, including decision papers that set out the risk, the options, and a recommendation.
- Improve risk workflows through better tooling, clearer operating models, and reusable knowledge assets such as runbooks and templates.
- Mentor and onboard analysts and junior team members on risk analysis, risk statement quality, treatment planning, and stakeholder communication.
Basic Qualifications
- Bachelor's degree in Computer Science, Computer Engineering, Information Systems, Cybersecurity, Risk Management, or a related field, or equivalent practical experience.
- 5+ years of experience in security, cyber risk, GRC, assurance, security operations, or related technical risk roles.
- Experience running parts of a security risk program end to end, including risk assessments, treatment decisions, and cross-functional follow-through.
- Strong understanding of security controls and risk treatment, with the technical fluency to work with engineers on implementation details in areas such as identity and access, cloud infrastructure, logging, vulnerability management, and secure configuration.
- Hands-on automation experience, including scripting in Python or a similar language, querying data with SQL, and using APIs or workflow tools to automate a process.
- Knowledge of control frameworks and standards such as NIST CSF, NIST 800-53, ISO 27001, SOC 2, and CIS.
- Experience working across multiple stakeholders, handling ambiguity, and driving accountability with limited supervision.
- Excellent written and verbal communication skills, including presenting risk, status, and decision points to director-level and technical audiences.
Preferred Qualifications
- Security or audit certifications such as CISA, CISSP, CISM, CRISC, or ISO 27001 Lead Auditor.
- Hands-on experience with the ServiceNow eGRC platform, including configuration, workflow development, and integration.
- Experience with other GRC or ERM tools such as AuditBoard, Archer, OpenPages,Vanta or SAP GRC.
- Experience applying AI or LLM tools to risk work, such as summarizing evidence, classifying findings, or drafting assessments, with appropriate human review.
- Experience with risk quantification methodologies and risk lifecycle tooling.
- Experience building dashboards in tools such as Tableau, Looker, or ServiceNow Performance Analytics.
- Big 4 accounting firm and/or internet or technology industry experience.
- Process management experience, including process redesign and optimization.
- Track record of driving security risk treatment to closure across multiple engineering teams.
- Ability to thrive in environments of uncertainty.
About the role and team
Engineering at Uber means building for real-world impact under real-world constraints. The problems are complex, the systems are massive, and the pace is fast. You’ll need to make smart decisions with imperfect information — and own them. If you think in systems, stay calm under pressure, and care about building things that actually work — this is where you’ll grow.
As a Sr. Security Technologist, you will lead high-stakes initiatives in our << insert team details here >> . This role sits at the nexus of technical investigation and scalable defense, blending the roles of a "Fire Captain" orchestrating critical-severity incident responses and a "Software Architect" building automated control assurance for our global cloud footprint. We are looking for a leader who can stay composed while communicating incident strategies to executives and then pivot to developing backend automation to reduce manual risk. You’ll set the technical standard for incident handling and continually elevate the craft of security across the organization.
What you’ll do
- Lead security incident response teams through high-criticality cybersecurity events, serving as the primary incident commander and orchestrating containment with confidence under intense pressure.
- Design, develop, and implement automated assurance controls and risk detection systems (using Python, Go, or Java) to replace manual testing across BPO, network, and cloud environments.
- Perform detailed root cause analysis and forensic investigations into sophisticated attacks, ensuring a rigorous technical understanding to prevent recurrence.
- Partner cross-functionally with Engineering and DevOps to integrate automated control validation into CI/CD pipelines and the software development lifecycle.
- Lead projects to mature the incident response program, including highly technical tabletop exercises, purple teaming, and large-scale threat hunting initiatives.
- Mentor junior analysts and specialists, coaching them in advanced investigative methodologies and elevating the technical craft of automation across the global organization.
Basic Qualifications
- Bachelor's degree in Computer Science, Engineering, Information Security, or a related technical field (or equivalent professional experience).
- Minimum 5+ years of experience in blue team functions (SOC, IR, detection) or GRC automation at a global company.
- Proficiency in backend programming (Python, Go, or Java) to build custom security tooling and automate manual testing environments.
- Demonstrated mastery in driving extremely complex and ambiguous security incidents to closure, including technical investigation and executive-level strategy communication.
- Experience planning and running incident simulations such as tabletop exercises or compromise assessments with an emphasis on highly technical scenarios.
- Proven track record of leading high-impact technical problems by weighing risks and tradeoffs while orchestrating work across multiple teams.
Preferred Qualifications
- Prior experience in a high-growth tech company where scale and complexity were significant operational factors.
- Advanced expertise in building test automation frameworks or utilizing RPA tools to streamline compliance workflows.
- Hands-on experience integrating Generative AI/ML technologies to automate incident triage, risk detection, or remediation workflows.
- Broad cybersecurity domain knowledge across infrastructure, product security, workload identity, and data security.
- Master’s or PhD degree in Computer Science, Engineering, or a related field.
—---
SCRAP
—-----
Role #1
About the role and team
Engineering at Uber means building for real-world impact under real-world constraints. The problems are complex, the systems are massive, and the pace is fast. You’ll need to make smart decisions with imperfect information — and own them. If you think in systems, stay calm under pressure, and care about building things that actually work — this is where you’ll grow.
As a Sr. Security Technologist, you will lead high-stakes initiatives across GRC Automation and Incident Command. This role sits at the nexus of technical investigation and scalable defense. You’ll blend the roles of a "Fire Captain" orchestrating critical-severity incident responses and a "Software Architect" building automated control assurance for our global cloud footprint. We are looking for a leader who can stay composed while communicating incident strategies to executives, and then pivot to developing Python-based automation to reduce manual risk assessments.
What you’ll do
- Lead security incident response teams through high-criticality cybersecurity events, orchestrating containment and remediation with confidence under intense pressure.
- Design, develop, and implement automated assurance controls to replace manual testing across BPO, network, and cloud environments (AWS, Azure, GCP).
- Build and deploy automated systems to detect and report risks across the organization, providing timely insights that help teams prioritize remediation efforts.
- Partner cross-functionally with Engineering and DevOps to integrate automated control validation into CI/CD pipelines and software development lifecycles.
- Perform detailed root cause analysis and forensic investigations, ensuring issues are understood at a technical level to prevent recurrence.
- Mentor junior analysts and specialists, elevating the technical craft of incident response and GRC automation across the global security organization.
Basic Qualifications
- Minimum 5 years of experience in blue team functions (SOC, IR, detection) or GRC automation at a global company.
- Demonstrated security mastery and technical depth that extends into dependency areas, with a track record of translating ambiguous technical issues into prioritized courses of action.
- Proven ability to operate successfully in cases of limited or poorly defined outcomes, active in creating technical transparency through cross-team artifact reviews.
- Exceptional communication skills with the ability to convey complex topics to cross-functional audiences (including Director level) via reusable and scalable ERDs, technical narratives, and slide decks.
- Strategic leader who acts as a cultural role model, mentoring team members beyond onboarding to help them grow and drive standards of excellence.
- Experience tackling large, high-impact technical problems by weighing risks and tradeoffs and orchestrating work that spans multiple teams and stakeholders.
- Record of delivering high-quality solutions, frameworks, and processes that anticipate scale, reliability, and extensibility while promoting industry best practices.
- Proficiency in backend programming (Python, Java, or Go) to build custom security tooling and automate manual testing environments.
- Bachelor’s degree in Computer Science, Engineering, Information Security, or a related technical field (or equivalent professional experience).
Preferred Qualifications
- Prior experience in a high-growth tech company where scale and complexity were significant operational factors.
- Expertise in building test automation frameworks or utilizing RPA tools (e.g., UiPath) to streamline compliance workflows.
- Hands-on experience integrating Generative AI/ML technologies to automate incident triage or risk detection.
- Broad cybersecurity domain knowledge across infrastructure, product security, and workload identity.
- Advanced experience in planning technical incident simulations, purple teaming, or compromise assessments.
Role #2
About the Role
As a Senior Security Incident Commander, you will be leading both the strategic and deeply technical aspects of the incident response process for critical-severity and large-scale incidents. You’ll blend the roles of Fire Captain, Air Traffic Controller, and NTSB Investigator - not only orchestrating the response with confidence under pressure, but also diving into technical investigations to ensure issues are understood and remediated at their root. You’ll leverage your in-depth knowledge of security tools, systems, and threat actor methodologies to bolster Uber’s security posture. In this role, you will also pioneer improvements to our incident response program, exploring cutting-edge technologies, novel detection and containment strategies, and advanced investigative techniques. As a leader in Engineering Security, you’ll set the technical standard for incident handling and continually elevate the craft of incident response across the organization.
---- What the Candidate Will Do ----
- Join an on-call rotation to lead security incident response teams for high-criticality cybersecurity incidents across Uber and its subsidiaries.
- Remain composed and technically effective under pressure, quickly pivoting between high-level strategic decisions and hands-on problem-solving.
- Serve as the primary point of contact throughout the incident lifecycle, including direct interaction with executives and cross-functional teams.
- Build strong partnerships with global teams to coordinate investigations, share technical insights, and respond effectively to incidents wherever they occur.
- Mentor and guide junior analysts, coaching them in advanced investigative methodologies and helping them develop deeper technical skills.
- Perform detailed root cause analysis, ensuring a rigorous technical understanding of incidents and creating actionable plans to prevent recurrence.
- Lead or contribute to projects that mature the incident response program including IR tabletop exercises, real-time incident simulations, threat hunting, and compromise assessments- to drive continuous improvement in detection, response, and remediation capabilities.
---- Basic Qualifications ----
- 5+ years of experience in blue team functions (SOC, IR, detection) at a global company, with a proven ability to handle complex, large-scale incidents.
- Deep familiarity with common threat actor attack patterns and TTPs, as well as an understanding of how to detect and disrupt them.
- Demonstrated success in driving extremely complex and ambiguous security incidents to closure, including technical investigation and remediation.
- Experience presenting incident strategy to executives, translating technical findings into clear, actionable business insights.
- Hands-on technical aptitude, including proficiency in reading logs, comfortable command-line usage, and the ability to dive deep into system, network, or application data to pinpoint root causes.
- Experience planning and running incident simulations such as tabletop exercises, purple teaming, etc., with an emphasis on highly technical scenarios.
---- Preferred Qualifications ----
- Willingness and experience leading and mentoring others, both technically and procedurally.
- A strong sense of urgency and drive - always looking to improve detection, response, and remediation strategies.
- Prior experience in incident response at a large tech company, where scale and complexity were significant factors.
- Broad cybersecurity domain knowledge - including infrastructure security, endpoint security, product security, and data security - to contextualize incidents within the broader security ecosystem.
- Hands-on scripting and/or coding skills (Python, Go, or similar) to build custom tooling, automate workflows, and/or enhance response capabilities.
- Experience utilizing or integrating generative AI/ML technologies to streamline incident detection, triage, and remediation workflows.
Role #3
---- What the Candidate Will Do ----
- Conduct rapid response, mitigation, investigations and forensics on highest priority incidents impacting Uber and user data.
- Partner with global team members to drive response and investigations globally.
- Partner closely with incident commanders, leading incident investigations.
- Produce concise yet thorough case reports for internal and external stakeholders.
- Lead automation projects and develop automation to improve the consistency and efficiency of incident response leveraging GenAI.
- Lead projects/initiatives to help mature the incident response program and reduce cybersecurity risk at Uber and Uber’s subsidiaries.
- Support and mentor others on automation development.
---- Basic Qualifications ----
- Bachelor's degree in Computer Science, Engineering, Cybersecurity or a related field
- 5+ years of hands-on experience on a security engineering team
- Proficiency in at least one of the following programming languages: Python or Go
- Strong foundation in security principles.
- Cybersecurity knowledge across multiple domains such as network, hosts, applications, data, cloud etc.
- Familiarity with common threat actor attack patterns and TTPs.
- Strong problem-solving skills.
---- Preferred Qualifications ----
- Master’s or PhD degree in Computer Science, Engineering, or a related field
- Experience with cybersecurity forensic methodologies and software.
- Experience driving complex incidents or leading large investigations end-to-end.
- Experience with building automations for incident response.
- Experience leading large-scale threat hunts.
- Applied knowledge of cyber intel frameworks such as ATT&CK framework and kill-chain model.
- Experience working crisis events for a global company. Ability to work across geographically distributed teams.
- Certifications in Security is a plus.
For Seattle, WA-based roles: The base salary range for this role is USD $180,000 per year - USD $200,000 per year.
You will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.
Ready to Ride?
This isn't the kind of place where you follow a playbook — it's where you help write one. If you're driven by impact, energized by challenge, and ready to shape how the world moves — we'd love to hear from you.
You may be eligible for bonuses, equity, and other compensation, as well as a range of benefits. Explore our benefits.
Offices remain key to collaboration and Uber's culture. Unless approved for full remote work, employees must spend at least 50% of their time in-office. Some roles, like those at greenlight hubs, require full-time in-office presence. Ask your Recruiter for details about this role's requirements.
Uber is proud to be an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires accommodation, please let us know by completing this form.