Uber’s Incident Command and Cyber Resilience team, part of the Threat Defense and Response (TDR) organization, leads the response to our highest-severity cybersecurity incidents and continuously tests our ability to detect, respond to, and recover from threats. We protect Uber’s people, products, infrastructure, and data across the intersection of the digital and physical world.
We are looking for an experienced engineering manager to lead a global team and own the strategy, roadmap, and execution across Incident Command, Purple Team, the Insider Threat Program, and Cyber Resilience. You will establish clear command during critical incidents, bring the right teams together, and drive decisions that reduce harm and restore secure operations.
Your responsibility extends beyond the incident itself. You will turn lessons from real events, adversary emulation, and continuous testing into stronger detections, more effective response, and demonstrated readiness. You will also guide engineering investments in automation and AI that improve response speed and quality while preserving human judgment and accountability.
This role requires a leader who can make sound decisions with incomplete information, communicate clearly under pressure, and develop people who do the same.
What the Candidate Will Do
Lead Incident Command. Manage and develop a global team of incident commanders responsible for Uber’s highest-severity cybersecurity incidents, including active threats, critical vulnerabilities, insider risks, and security incidents involving large-scale fraud. Serve as a senior escalation point and assume command when needed.
Drive decisions and coordinated execution. Establish incident objectives, roles, priorities, escalation paths, and operating cadence. Coordinate investigation, containment, remediation, and recovery across Security, Infrastructure, Product, and Business teams, resolving dependencies and driving actions to completion.
Lead sensitive incident coordination and communication. Partner with Legal, Privacy, People, Communications, and other stakeholders to navigate complex incidents. Give executives clear assessments of impact, uncertainty, response options, and decisions required.
Own the Cyber Resilience program. Establish continuous testing and validation of detection and response capabilities across people, processes, and technology. Test the full path from adversary activity through telemetry, detection, triage, escalation, containment, and recovery.
Lead Purple Team. Set priorities for collaborative adversary emulation and testing with offensive security, threat intelligence, detection engineering, and response teams. Use realistic attack scenarios to expose gaps, drive improvements, and retest to verify that fixes work.
Own the Insider Threat Program. Define the program’s strategy, operating model, and roadmap with Security, Legal, Privacy, and People partners. Strengthen prevention, detection, investigation, and response to insider risks, with disciplined handling of sensitive information and respect for employee privacy.
Build organizational readiness. Own tabletop exercises, incident simulations, premortems, and post-incident reviews. Translate internal lessons, external incidents, and emerging threats into prioritized improvements with clear owners and verified outcomes.
Guide engineering, automation, and AI investments. Lead the development and integration of tools that improve incident coordination, evidence synthesis, decision support, and readiness testing. Define clear approval boundaries, auditability, and human oversight for consequential actions.
Set direction and measure results. Own the team’s roadmap, staffing, and delivery commitments. Establish measures for command readiness, detection and response effectiveness, validated threat coverage, and closure of recurring gaps. Integrate security response and production incident management practices to improve execution across Uber.
Build and grow the team. Hire, coach, and develop incident commanders and engineers. Set clear expectations for performance and technical quality, support career growth, and build an inclusive culture grounded in accountability, sound judgment, and continuous learning.
8+ years of experience in security incident response, security engineering, production incident management, or security and infrastructure operations.
Experience directly managing technical teams, including hiring, performance management, career development, and delivery accountability.
Experience serving as incident commander or incident lead for high-severity cybersecurity or production incidents in complex, distributed environments.
Demonstrated ability to establish command, prioritize actions, and drive decisions across teams with competing demands and incomplete information.
Working knowledge of cybersecurity investigation, containment, and recovery across infrastructure, applications, identity, and cloud services.
Experience owning a technical program or operational capability, including setting priorities, delivering improvements, and measuring effectiveness.
Strong written and verbal communication skills, including communicating technical risk, business impact, and response decisions to senior leaders.
Experience managing a cybersecurity incident command or response team operating globally with on-call and follow-the-sun coverage.
Experience building or leading Purple Team, adversary emulation, or continuous security validation programs, using frameworks such as MITRE ATT&CK to prioritize and assess coverage.
Experience leading an Insider Threat Program or coordinating sensitive insider investigations with Legal, Privacy, and People teams.
Experience designing exercises that test detection, escalation, containment, and recovery, and translating findings into verified improvements.
Experience leading engineering teams that build incident management platforms, response automation, or AI-assisted operational workflows.
Experience integrating cybersecurity response with SRE or production incident management practices.
A track record of improving response effectiveness through post-incident learning, measurable readiness standards, and sustained remediation of systemic gaps.
For Seattle, WA-based roles: The base salary range for this role is USD $232,000 per year - USD $258,000 per year.
You will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.
About UsReady to Ride?
This isn't the kind of place where you follow a playbook — it's where you help write one. If you're driven by impact, energized by challenge, and ready to shape how the world moves — we'd love to hear from you.
You may be eligible for bonuses, equity, and other compensation, as well as a range of benefits. Explore our benefits.
Offices remain key to collaboration and Uber's culture. Unless approved for full remote work, employees must spend at least 50% of their time in-office. Some roles, like those at greenlight hubs, require full-time in-office presence. Ask your Recruiter for details about this role's requirements.
Uber is proud to be an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires accommodation, please let us know by completing this form.
Skills Required
- 8+ years of experience in security incident response, security engineering, production incident management, or security and infrastructure operations
- Experience directly managing technical teams, including hiring, performance management, career development, and delivery accountability
- Experience serving as an incident commander or incident lead for high-severity cybersecurity or production incidents in complex, distributed environments
- Ability to establish command, prioritize actions, and drive decisions across teams with competing demands and incomplete information
- Working knowledge of cybersecurity investigation, containment, and recovery across infrastructure, applications, identity, and cloud services
- Experience owning a technical program or operational capability, including setting priorities, delivering improvements, and measuring effectiveness
- Strong written and verbal communication skills, including communicating technical risk, business impact, and response decisions to senior leaders
- Experience managing a global cybersecurity incident command or response team with on-call and follow-the-sun coverage
- Experience building or leading Purple Team, adversary emulation, or continuous security validation programs using frameworks such as MITRE ATT&CK
- Experience leading an Insider Threat Program or coordinating sensitive insider investigations with Legal, Privacy, and People teams
- Experience designing exercises that test detection, escalation, containment, and recovery, and translating findings into verified improvements
- Experience leading engineering teams that build incident management platforms, response automation, or AI-assisted operational workflows
- Experience integrating cybersecurity response with SRE or production incident management practices
- Track record of improving response effectiveness through post-incident learning, measurable readiness standards, and sustained remediation of systemic gaps
Uber Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Uber and has not been reviewed or approved by Uber.
-
Parental & Family Support — Policies provide a minimum of fully paid parental leave for all parents and financial support for fertility, adoption, and surrogacy, with added credits to ease the transition. Programs extend to family medical leave and parenting support resources, indicating depth beyond baseline offerings.
-
Healthcare Strength — Healthcare coverage is described as comprehensive across many countries, with medical, dental, vision, life, disability, and mental health benefits, plus allowances where direct plans are not available. Wellness programs and reimbursements further reinforce access to care.
-
Wellbeing & Lifestyle Benefits — Monthly ride and meal credits, free office meals/snacks, fitness stipends, onsite gyms, and wellbeing reimbursements create meaningful everyday value. Home‑office stipends, travel medical coverage, and counseling support round out lifestyle-oriented perks.
Uber Insights
What We Do
We are Uber. The go-getters. The kind of people who are relentless about our mission to help people go anywhere and get anything. Movement is what we do. It’s our lifeblood. It runs through our veins. It’s what gets us out of bed each morning. It pushes us to constantly reimagine how we can move better. For you. For all the places you want to go. For all the things you want to get. For all the ways you want to earn. Across the entire world. In real-time. At the incredible speed of now.
Why Work With Us
We welcome people from all backgrounds who seek the opportunity to help build a future where everyone and everything can move independently. If you have the curiosity, passion, and collaborative spirit, work with us, and let’s move the world forward, together.
Gallery
