About the role and team:
As a member of Uber’s Security Review Team, you will work across multiple security disciplines to proactively identify and reduce risk in Uber’s most critical services and emerging technologies. You will perform security design reviews and threat modeling for critical services and AI agents, conduct hands-on penetration testing to validate real-world attack paths, and help build AI-powered automation that transforms how these security assessments are performed at scale. This role combines deep technical security expertise with an automation-first mindset, helping evolve traditional point-in-time assessments toward continuous, scalable security testing across Uber’s technology ecosystem.
This isn't a "set and forget" role. Our environment is fast-moving and the threats are constantly evolving. You will navigate the "messy" reality of hybrid cloud and distributed systems, conducting technical security design reviews as part of our secure software development lifecycle. We are looking for a technically curious engineer who thrives in ambiguity, takes extreme ownership of their work, and has the grit to stay ahead of sophisticated adversaries. If you are motivated by high-stakes challenges and want to build a more secure future for movement - this is where you’ll grow.
What you’ll do
- Conduct security design reviews and threat modeling across Uber’s diverse codebase, evaluating security risks in services, applications, APIs, infrastructure, mobile platforms, AI systems, and other production software.
- Assess third-party AI agents, including coding and work-focused agents, through adversarial testing to identify security risks in agent behavior, tool use, data access, permissions, prompt injection, and external integrations.
- Perform hands-on penetration testing of critical Uber services, applications, APIs, infrastructure, and AI agents to identify exploitable vulnerabilities and complex attack paths
- Design and build AI-powered automation for security design reviews, threat modeling, penetration testing, increasing the scale, frequency, and depth of Offensive Security assessments.
- Partner with engineering and security teams to translate offensive security findings into systemic improvements, helping eliminate vulnerability classes and strengthen security controls across Uber’s technology ecosystem.
- Perform multi-disciplinary security design reviews of engineering proposals, analyzing cloud, infrastructure, application, and data-layer security.
- Navigate complex design trade-offs to provide corrective guidance that improves the overall security posture of Uber’s products and services.
- Collaborate with engineering teams across the company to analyze design documents and identify potential flaws before they reach production.
- Translate technical security findings into actionable guidance for both engineering and non-technical stakeholders to ensure alignment and impact.
- Conduct comprehensive security assessments, including threat modeling for web and mobile applications, to identify and mitigate risks at scale.
- Champion engineering best practices and serve as a security ambassador, helping teams move fast while building with integrity and care.
Basic Qualifications
- 3+ years of professional experience in security engineering, systems architecture, or a related software engineering field.
- Proven ability to analyze complex system designs and provide technical input to solve security challenges with multiple dependencies.
- Broad knowledge of threat modeling, vulnerability classification, and risk modeling frameworks.
- Experience with security designs related to cloud-native services, microservices, or distributed systems.
- Bachelor’s degree in Computer Science, Engineering, or equivalent practical experience.
Preferred Qualifications
- Hands-on experience performing security design reviews and threat modeling across complex applications, services, APIs, distributed systems, cloud infrastructure, and mobile platforms.
- Demonstrated ability to identify complex attack paths and systemic security weaknesses by reasoning across application, infrastructure, identity, data, and trust boundaries.
- Experience conducting code-assisted security reviews, using source code to validate architectural assumptions, security controls, data flows, authorization boundaries, and potential vulnerabilities.
- Experience reviewing large-scale distributed and cloud-native architectures, including microservices, service-to-service authentication, APIs, messaging systems, data stores, and multi-cloud environments.
- Advanced proficiency in at least one backend language such as Go, Java, or Python to evaluate code-level security.
- Hands-on experience with multi-cloud environments (e.g., AWS, GCP) and data store technologies (SQL or NoSQL).
- Experience applying AI/LLMs, agents, or automation frameworks to security testing, vulnerability discovery, threat modeling, or other security engineering workflows.
- Strong systems thinking with the ability to simplify complex technical concepts and influence without authority.
- Experience working within an automated CI/CD environment or a mature Secure Software Development Lifecycle (S-SDLC).
For Seattle, WA-based roles: The base salary range for this role is USD $171,000 per year - USD $190,000 per year.
For Sunnyvale, CA-based roles: The base salary range for this role is USD $171,000 per year - USD $190,000 per year.
For all US locations, you will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.
About UsReady to Ride?
This isn't the kind of place where you follow a playbook — it's where you help write one. If you're driven by impact, energized by challenge, and ready to shape how the world moves — we'd love to hear from you.
You may be eligible for bonuses, equity, and other compensation, as well as a range of benefits. Explore our benefits.
Offices remain key to collaboration and Uber's culture. Unless approved for full remote work, employees must spend at least 50% of their time in-office. Some roles, like those at greenlight hubs, require full-time in-office presence. Ask your Recruiter for details about this role's requirements.
Uber is proud to be an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires accommodation, please let us know by completing this form.
Skills Required
- 3+ years of professional experience in security engineering, systems architecture, or related software engineering
- Ability to analyze complex system designs and provide technical security input across multiple dependencies
- Knowledge of threat modeling, vulnerability classification, and risk modeling frameworks
- Experience with cloud-native services, microservices, or distributed systems security design
- Bachelor's degree in Computer Science, Engineering, or equivalent practical experience
- Experience performing security design reviews and threat modeling across applications, services, APIs, distributed systems, cloud infrastructure, and mobile platforms
- Ability to identify complex attack paths and systemic security weaknesses across application, infrastructure, identity, data, and trust boundaries
- Experience conducting code-assisted security reviews
- Experience reviewing large-scale distributed and cloud-native architectures
- Advanced proficiency in Go, Java, or Python
- Hands-on experience with AWS, GCP, and SQL or NoSQL data stores
- Experience applying AI, LLMs, agents, or automation frameworks to security workflows
- Strong systems thinking and ability to influence without authority
- Experience with automated CI/CD or a mature Secure Software Development Lifecycle
Uber Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Uber and has not been reviewed or approved by Uber.
-
Parental & Family Support — Policies provide a minimum of fully paid parental leave for all parents and financial support for fertility, adoption, and surrogacy, with added credits to ease the transition. Programs extend to family medical leave and parenting support resources, indicating depth beyond baseline offerings.
-
Healthcare Strength — Healthcare coverage is described as comprehensive across many countries, with medical, dental, vision, life, disability, and mental health benefits, plus allowances where direct plans are not available. Wellness programs and reimbursements further reinforce access to care.
-
Wellbeing & Lifestyle Benefits — Monthly ride and meal credits, free office meals/snacks, fitness stipends, onsite gyms, and wellbeing reimbursements create meaningful everyday value. Home‑office stipends, travel medical coverage, and counseling support round out lifestyle-oriented perks.
Uber Insights
What We Do
We are Uber. The go-getters. The kind of people who are relentless about our mission to help people go anywhere and get anything. Movement is what we do. It’s our lifeblood. It runs through our veins. It’s what gets us out of bed each morning. It pushes us to constantly reimagine how we can move better. For you. For all the places you want to go. For all the things you want to get. For all the ways you want to earn. Across the entire world. In real-time. At the incredible speed of now.
Why Work With Us
We welcome people from all backgrounds who seek the opportunity to help build a future where everyone and everything can move independently. If you have the curiosity, passion, and collaborative spirit, work with us, and let’s move the world forward, together.
Gallery
