Sr Security Technologist - Incident Commander

Uber Technologies Inc.; United States; On-site; USD 180,000 - 200,000; Full time

Benefits offered by this job

Bonuses

Equity

Benefits

Job summary

Uber Technologies Inc. seeks a Senior Security Technologist, Incident Command, to lead Uber's most high‑impact security incidents end‑to‑end—from escalation to containment, recovery, and systemic remediation.

You will set strategy, allocate resources, and make critical decisions under pressure. You will drive deep technical investigation, post‑incident analysis, and the evolution of detection, containment, and automation, collaborating with engineering, legal, privacy, and operations teams

Qualifications

• 5+ years in security operations, detection, or incident response roles at scale, with ownership of large incidents.
• Deep familiarity with modern attacker TTPs and their manifestation across logs, systems, networks, endpoints, and applications.
• Strong technical investigation skills with logs, telemetry, and raw system data to validate hypotheses.
• Experience briefing executives during active incidents, explaining risks and actions clearly.
• Experience designing or running incident simulations (tabletops, purple team) to test response.
• Experience building or leveraging AI-driven tooling to improve incident response.

Responsibilities

• Command the highest severity and most complex incidents as the accountable leader during active response.
• Participate in on-call rotations with real-time decision making under uncertainty.
• Set strategy, allocate resources, and direct investigative focus during incidents.
• Lead from executive interfaces, translating technical realities into risk and decision frameworks.
• Build relationships with global engineering, infrastructure, legal, privacy, and operations teams for coordinated response.
• Conduct rigorous post-incident analysis focused on systemic causes and prevention.
• Mentor responders and advance Uber's incident response program through simulations and tooling improvements.
• Lead adoption of new investigative techniques and AI-assisted workflows.

Skills

Security operations

TTPs knowledge

Investigation skills

Executive briefing

Incident simulations

AI tooling

Job description

About the Role

As a Senior Security Technologist, Incident Command, you are accountable for leading Uber’s most critical, complex, and high-impact security incidents end-to-end - from escalation to containment, recovery, and systemic remediation. This role will sit in either our Seattle, San Fransisco, or Sunnyvale office.

You operate at the intersection of Fire Captain, NTSB Investigator, and hands-on technical practitioner. In the moment, you take command - setting strategy, assigning resources, and making high-consequence decisions under pressure. After the smoke clears, you drive deep technical investigation and post-incident analysis to ensure we understand not just what happened, but why it happened, and that meaningful, durable fixes are made.

This is not a passive coordination role. You are expected to be technically credible, decisive in ambiguity, and comfortable owning outcomes when there is no playbook. You will shape how Uber responds to security incidents at scale - raising the technical bar, building and modernizing tooling and workflows, and influencing teams beyond Engineering Security.

What the Candidate Will Need / Bonus Points

---- What the Candidate Will Do ----

1. Command the highest severity and most complex security incidents across Uber and its subsidiaries, serving as the single accountable leader during active response.
2. Participate in an on-call rotation where you are expected to make real-time decisions with incomplete information, balancing speed, risk, and impact.
3. Act as the incident authority, not just a facilitator - forming hypotheses, setting strategy, and directing investigative focus.
4. Transition seamlessly between executive-level incident leadership and hands-on technical investigation, including log analysis, system interrogation, and root cause validation.
5. Serve as the primary interface to senior leadership during critical incidents, translating evolving technical realities into clear risk, impact, and decision frameworks.
6. Build and maintain strong working relationships with global engineering, infrastructure, legal, privacy, and operations teams to enable fast, coordinated response.
7. Conduct rigorous post-incident analysis in the spirit of an NTSB investigation - focused on systemic causes, contributing factors, and concrete prevention.
8. Mentor and develop other responders and incident leaders, raising the organization’s ability to handle complex, time-critical security events.
9. Lead and materially contribute to initiatives that mature Uber’s incident response program, including:
10. High-fidelity incident simulations and technical tabletop exercises
11. Threat-informed response planning and scenario development
12. 'Left of boom' threat modeling to prevent incidents before they occur
13. Improvements to detection, containment, and response automation
14. Adoption of new investigative techniques and tooling, including AI-assisted workflows

---- Basic Qualifications ----

1. 5+ years in security operations, detection, or incident response roles at scale, with demonstrated ownership of ambiguous, large, complex, high-impact incidents.
2. Deep familiarity with modern attacker TTPs and how they manifest across logs, systems, networks, endpoints, and applications.
3. Strong technical investigation skills - comfortable working directly with logs, telemetry, and raw system data to validate hypotheses and determine root cause.
4. Experience briefing executives during active incidents, with the ability to clearly explain tradeoffs, risks, and recommended actions.
5. Experience designing or running technical incident simulations (tabletops, purple team exercises, or similar) that stress real-world response capabilities.
6. Experience building or leveraging AI-driven tooling to improve incident response posture, applying frontier technology to workflows such as triage, investigation, correlation, or decision support.

---- Preferred Qualifications ----

1. Demonstrated experience leading other responders through direct command during incidents and longer-term technical mentorship.
2. Strong bias for action and continuous improvement - uncomfortable with leaving with a shrug if things aren’t right.
3. Experience responding to incidents in highly distributed, cloud-scale environments where blast radius and coordination complexity are significant.
4. Broad security domain knowledge (infrastructure, endpoint, product, identity, data) and the ability to reason across them during incidents.
5. Ability to script or code (Python, Go, or similar) to automate response tasks, prototype tooling, or close operational gaps.

For San Francisco, CA-based roles: The base salary range for this role is USD $180,000 per year - USD $200,000 per year.

For Seattle, WA-based roles: The base salary range for this role is USD $180,000 per year - USD $200,000 per year.

For Sunnyvale, CA-based roles: The base salary range for this role is USD $180,000 per year - USD $200,000 per year

You may be eligible for bonuses, equity, and other compensation, as well as a range of benefits. Explore our benefits.

Offices remain key to collaboration and Uber's culture. Unless approved for full remote work, employees must spend at least 50% of their time in-office. Some roles, like those at greenlight hubs, require full-time in-office presence. Ask your Recruiter for details about this role's requirements.

Uber is proud to be an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires accommodation, please let us know by completing this form.