Sr Staff Security Engineer - Engineer

Uber; Seattle (WA); On-site; USD 260,000 - 360,000; Full time

Job summary

Uber is seeking a Senior Staff Security Engineer focused on the supply chain, offensive security, and AI security. You will design and build security platforms, developer tooling, and automation to protect Uber's software ecosystem at scale.

This hands-on role requires production-grade coding to secure code, dependencies, and pipelines, plus tooling for automated testing and remediation. You will influence security strategy across Security, Developer Infrastructure, and Engineering, embedding

Qualifications

• 10+ years of production software/ security engineering experience in complex systems.
• Advanced proficiency in Go, Java, Python, or C++ or similar languages.
• Deep understanding of source control, build systems, CI/CD, containers, and cloud-native deployment.

Responsibilities

• Build software supply chain protections: signing, provenance, and secure builds across pipelines.
• Engineer dependency security: SBOMs, vulnerable packages, transitive risks, and automated remediation.
• Deliver scalable security platforms: combine SAST/DAST/ SCA with AI-powered analysis across PRs and CI/CD.
• Turn threat models into engineering controls across applications, APIs, and cloud infra.
• Build offensive security capabilities: automated pentesting, DAST, and exploit validation.
• Develop AI-powered security tools to test AI systems and agents, incl. MCP servers.
• Make findings actionable: prioritize risk and improve coverage and adoption.
• Own production engineering direction: define architectures, APIs, and safety controls.

Skills

Go/Java/Python/C++

Systems architecture

Secure software delivery

Threat modeling

Offensive security

Infrastructure security

Technical ownership

Cross-team collaboration

Education

Bachelor's degree in CS/Engineering or related

Tools

Jfrog Artifactory

Jenkins

GitHub Actions

GitLab CI/CD

Buildkite

CircleCI

Argo CD

SLSA/Sigstore/OpenSSF

Job description

Senior Staff Security Engineer - Supply Chain, Offensive & AI Security

About this role and team

As a Senior Staff Security Engineer, you will define and build security platforms, developer tooling, and AI-powered automation that protect the company's software ecosystem at scale. Securing the software supply chain will be a core focus, alongside continuous offensive testing and security assessments of AI applications and autonomous agents.

This is a deeply technical, hands-on role. You will write production-quality code to protect source code, dependencies, build infrastructure, artifacts, and deployment pipelines. You will also build systems that automate penetration testing, vulnerability discovery and validation, adversarial AI testing, and remediation. Your work will advance both the use of AI to improve security and the security of AI itself, including first-party and third-party agents, LLM integrations, Model Context Protocol (MCP) servers, and autonomous workflows.

Working across Security, Developer Infrastructure, and Engineering, you will establish technical strategy and lead complex initiatives from concept through deployment and long-term operation. You will embed controls into developer workflows, turn manual assessments into continuous capabilities, and eliminate systemic weaknesses through secure defaults and platform improvements.

Successful candidates combine expert software engineering with deep expertise in securing software delivery and offensive security. They build scalable systems that reduce real-world risk while improving developer productivity.

What you'll do

• Build software supply chain protections. Implement source code integrity, commit signing, code, artifact, and container signing, provenance verification, dependency integrity, and cryptographic verification. Establish standards and automated enforcement for secure builds, artifact repositories, container registries, and deployment pipelines that prevent untrusted code, unsigned artifacts, vulnerable dependencies, and noncompliant software from advancing.
• Engineer dependency security and remediation systems. Build capabilities to inventory and assess open-source components, manage SBOMs, detect vulnerable or malicious packages and transitive dependency risks, and mitigate supply chain compromise. Automate dependency upgrades, secure patches, code fixes, and verification of remediation effectiveness.
• Deliver scalable application security platforms. Integrate SAST, DAST, SCA, secrets detection, and AI-powered analysis into code generation, development, pull requests, and CI/CD. Analyze source code, build configurations, infrastructure definitions, containers, and artifacts at scale, and provide actionable feedback with minimal developer friction.
• Turn threat models into engineering controls. Model threats across applications, APIs, identity systems, build infrastructure, cloud environments, and AI workflows. Identify trust boundaries, abuse cases, and attack paths, then implement secure defaults, reusable libraries, architectural improvements, and regression tests that eliminate recurring vulnerability classes.
• Build continuous offensive security capabilities. Develop automated penetration testing, DAST, attack orchestration, and exploit validation systems for applications, APIs, mobile services, infrastructure, and externally accessible endpoints. Identify authorization weaknesses, business logic flaws, privilege escalation, and chained attacks, using isolated execution environments, attack sandboxes, and controls appropriate for production testing.
• Build AI-powered security tools and test AI systems. Apply frontier models, security‑specific models, and autonomous agents to discovery, attack planning, validation, secure coding, and remediation. Assess first‑party and third‑party agents, LLM integrations, MCP servers, and agent tools for prompt injection, tool poisoning, unauthorized execution, data exposure, and trust boundary violations.
• Make findings accurate and actionable. Correlate and deduplicate findings, combine deterministic analysis with AI reasoning, dynamic testing, exploit verification, and human review, and prioritize validated risk. Continuously reassess applications and agents as code, configurations, models, tools, and integrations change.
• Own production engineering and technical direction. Write maintainable, tested code; define architectures, APIs, interfaces, safety controls, and engineering standards; and operate reliable distributed services. Evaluate emerging technologies, prototype quickly, and lead initiatives across teams with clear milestones and measurable outcomes.
• Raise engineering quality and adoption. Mentor senior engineers, lead design and code reviews, and partner with infrastructure and product teams to embed security into existing workflows. Communicate investment priorities and measure improvements in coverage, accuracy, remediation, developer adoption, productivity, and risk reduction.

Basic qualifications

• Production software engineering: 10+ years of experience in software engineering, security engineering, or related technical fields, including significant experience designing, coding, testing, deploying, and operating complex production systems. Advanced proficiency in Go, Java, Python, C++, or a comparable language.
• Systems architecture: Experience building large-scale distributed systems, developer platforms, security services, or infrastructure, supported by strong fundamentals in data structures, algorithms, APIs, concurrency, system design, and software architecture.
• Secure software delivery: Deep understanding of source control, build systems, dependency management, CI/CD, containers, and cloud-native deployment, with experience implementing automated controls in developer workflows. Expert-level depth in application security, software supply chain security, or DevSecOps.
• Application security and threat modeling: Strong understanding of secure design, authentication, authorization, trust boundaries, and application and API vulnerabilities, including OWASP Top 10, injection, business logic flaws, and multi-step attacks. Ability to translate threat models and security findings into concrete engineering changes.
• Offensive security engineering: Expert-level depth in penetration testing, vulnerability research, exploit development, application testing, or adversarial testing, with experience building or integrating scanners, exploitation frameworks, DAST, or automated validation capabilities.
• Infrastructure security: Strong fundamentals in network, cloud, and infrastructure security, and familiarity with microservices, Kubernetes, distributed applications, and modern cloud-native architectures.
• Technical ownership: Demonstrated ability to resolve ambiguous problems and independently lead initiatives across teams from problem definition through implementation and long-term operation, using scalable engineering solutions to address systemic weaknesses.
• Influence and collaboration: Ability to establish technical direction without direct authority, communicate architectural decisions, and work effectively across security and engineering organizations.
• Bachelor's degree in Computer Science, Engineering, Cybersecurity, or a related technical field, or equivalent practical experience.

Preferred qualifications

• Supply chain integrity and standards: Expertise in SBOMs, software provenance, dependency integrity, code, artifact, and container signing, and cryptographic verification; experience implementing SLSA, Sigstore, in-toto, OpenSSF, or equivalent frameworks and technologies.
• Build and delivery infrastructure: Deep experience with CI/CD architecture, artifact repositories, container registries, deployment orchestration, and automated policy enforcement. Hands‑on experience with tools such as JFrog Artifactory, Jenkins, GitHub Actions, GitLab CI/CD, Buildkite, CircleCI, and Argo CD, including integrations with source control, Kubernetes, and cloud infrastructure.
• Security platform development: A record of shipping and operating backend services, analysis engines, and developer infrastructure across large codebases, monorepos, microrepositories, and distributed environments. Expertise in SAST, DAST, SCA, secrets scanning, secure code analysis