Security Technologist II: Risk & Assurance Automation

Uber; United States; On-site; USD 153,000 - 170,000; Full time

Benefits offered by this job

Bonuses

Equity

Benefits

Job summary

Uber’s Tech Risk and Assurance team seeks a Security Technologist II to test security controls across Uber’s systems and automate testing at scale. You will read configurations, write Python scripts and SQL queries, and support risk assessments and audits while collaborating with engineering, audit, and compliance teams.

You will help maintain risk registers, track POA&Ms, and explore AI-powered solutions to streamline evidence collection and findings analysis.

Qualifications

• 3+ years of experience in IT audit, security assurance, risk assessment, or a related technical role.
• Experience assessing control design and operating effectiveness across enterprise IT and cloud environments.
• Technical fluency in areas such as identity and access management, cloud infrastructure (AWS, GCP, or OCI), logging and monitoring, vulnerability management, or change management.
• Hands-on automation experience, including scripting in Python or a similar language and querying data with SQL to collect evidence, test controls, or analyze results.
• Experience with audit remediation tracking, risk registers, or corrective action management.
• Knowledge of control frameworks and standards such as NIST CSF, NIST 800-53, ISO 27001, SOC 2, CIS, and PCI DSS.
• Excellent written and verbal communication skills, including writing clear findings for technical and non-technical audiences.

Responsibilities

• Test the design and operating effectiveness of security controls across enterprise IT, cloud, SaaS, and third-party environments, and document clear, evidence-based findings.
• Conduct control and configuration assessments to identify deviations from policy, standards, and baseline requirements, and give guidance on remediation and audit readiness.
• Build and maintain automated control tests and continuous control monitoring in partnership with system owners, so that controls are tested on full populations rather than samples.
• Write scripts and queries to collect and validate audit evidence, reducing manual effort for the assurance team and engineering stakeholders.
• Support internal and external audits and certifications, such as SOC 2, ISO 27001, PCI DSS, and regional regulatory assessments, including evidence requests and walkthroughs.
• Track corrective actions from audits and assessments, including Plans of Action and Milestones (POA&Ms), and follow up with owners until issues are closed.
• Support risk assessments of systems, applications, and vendors. Gather context, identify risks to the confidentiality, integrity, and availability of information systems, and draft risk statements and treatment recommendations.
• Maintain risk register and issue records so that each risk has a current rating, owner, and status, and link control test results and audit findings to the risks they affect.
• Review security exception requests for completeness, compensating controls, and expiry, and flag repeat or long-running exceptions for escalation.
• Explore and implement AI- and LLM-based solutions, for example to classify security findings, summarize audit trails, or perform first-pass reviews of third-party security reports.
• Build dashboards and reports on control test results, issue aging, and exception trends for the team and partner teams.
• Recommend improvements to policies, procedures, and standards based on control testing results.
• Improve runbooks and documentation for the processes you work on, and help onboard new team members.

Skills

IT audit

Security assurance

Risk assessment

Python scripting

SQL querying

Cloud infrastructure (AWS/GCP)

Education

Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or related field

Tools

ServiceNow eGRC

AuditBoard

Jira

Archer

Job description

Uber’s Tech Risk and Assurance team seeks a Security Technologist II to test security controls across Uber’s systems and automate testing at scale. You will read configurations, write Python scripts and SQL queries, and support risk assessments and audits while collaborating with engineering, audit, and compliance teams.

You will help maintain risk registers, track POA&Ms, and explore AI-powered solutions to streamline evidence collection and findings analysis.