Staff Security Engineer

Uber; San Francisco (CA); On-site; USD 232,000 - 258,000; Full time

Benefits offered by this job

401(k) plan

Bonus program

Equity award

Benefits

Job summary

Uber’s Offensive Security team seeks an experienced security engineer to perform design reviews, threat modeling, and hands-on penetration testing across critical services and AI agents. You will build AI-powered automation to scale assessments and collaborate with engineering teams to improve security controls across Uber’s technology ecosystem.

The role emphasizes automation-first security testing in a fast-moving, hybrid cloud environment with a focus on continuous improvement and actionable

Qualifications

• Must have deep knowledge of threat modeling and vulnerability assessment.
• Experience applying offensive security methodologies in production environments.
• Strong track record leading security assessments across services and teams.

Responsibilities

• Perform hands-on penetration testing of Uber services, APIs, and infrastructure.
• Conduct security design reviews and threat modeling for AI agents and systems.
• Design AI-powered automation to scale security assessments.
• Translate findings into systemic security improvements with engineering teams.
• Review engineering proposals for cloud, infrastructure, and data security.
• Provide actionable guidance to engineers and non-technical stakeholders.

Skills

Threat modeling

Security design reviews

Penetration testing

AI/LLMs in security

Security automation

Security architecture

Vulnerability discovery

Cross-team collaboration

Education

Master's degree or PhD in a technical field

Job description

About The Role And Team

As a member of Uber's Offensive Security team, you will work across multiple security disciplines to proactively identify and reduce risk in Uber's most critical services and emerging technologies. You will perform security design reviews and threat modeling for critical services and AI agents, conduct hands-on penetration testing to validate real-world attack paths, and help build AI-powered automation that transforms how these security assessments are performed at scale. This role combines deep technical security expertise with an automation-first mindset, helping evolve traditional point-in-time assessments toward continuous, scalable security testing across Uber's technology ecosystem.

This isn't a "set and forget" role. Our environment is fast-moving and the threats are constantly evolving. You will navigate the "messy" reality of hybrid cloud and distributed systems, conducting technical security design reviews as part of our secure software development lifecycle. We are looking for a technically curious engineer who thrives in ambiguity, takes extreme ownership of their work, and has the grit to stay ahead of sophisticated adversaries. If you are motivated by high-stakes challenges and want to build a more secure future for movement - this is where you'll grow.

What You'll Do

• Perform hands-on penetration testing of critical Uber services, applications, APIs, infrastructure, and AI agents to identify exploitable vulnerabilities and complex attack paths.
• Conduct security design reviews and threat modeling for AI agents and agentic systems, evaluating risks across models, tools, data, permissions, external integrations, and runtime behavior.
• Design and build AI-powered automation for security design reviews, threat modeling, penetration testing, and vulnerability validation, increasing the scale, frequency, and depth of Offensive Security assessments.
• Partner with engineering and security teams to translate offensive security findings into systemic improvements, helping eliminate vulnerability classes and strengthen security controls across Uber's technology ecosystem.
• Perform multi-disciplinary security design reviews of engineering proposals, analyzing cloud, infrastructure, application, and data-layer security.
• Navigate complex design trade-offs to provide corrective guidance that improves the overall security posture of Uber's products and services.
• Collaborate with engineering teams across the company to analyze design documents and identify potential flaws before they reach production.
• Translate technical security findings into actionable guidance for both engineering and non-technical stakeholders to ensure alignment and impact.
• Conduct comprehensive security assessments, including threat modeling for web and mobile applications, to identify and mitigate risks at scale.
• Champion engineering best practices and serve as a security ambassador, helping teams move fast while building with integrity and care.

Basic Qualifications

• 7+ years of professional experience in security engineering, threat detection, or client platform engineering.
• Demonstrated ability to independently analyze complex, large-scale system designs, identify security risks and attack paths, and drive technical solutions across multiple services, systems, and dependencies.
• Deep knowledge of threat modeling, vulnerability discovery and classification, security risk assessment, and offensive security methodologies, with experience applying them to complex production environments.
• Extensive experience assessing the security of cloud-native services, microservices, distributed systems, APIs, or other large-scale production environments.
• Proven ability to lead complex security assessments and influence engineering teams to implement security improvements across organizational and technical boundaries.
• Experience applying AI/LLMs, agents, or automation frameworks to security testing, vulnerability discovery, threat modeling, or other security engineering workflows.
• Hands-on experience conducting penetration testing of complex applications, services, APIs, and infrastructure, including identifying, validating, and demonstrating exploitable vulnerabilities and attack paths.

Preferred Qualifications

• Master's degree or PhD in a technical field and 10+ years of experience in a cybersecurity leadership or staff-level role.
• Deep knowledge of Cybersecurity, Compliance, and Privacy, with experience chaining vulnerabilities and quantifying risks.
• Experience collaborating with EMs, TPMs, and PMs on prioritization, headcount planning, and technical evaluation of team members.
• Advanced expertise in leveraging AI/ML for security use cases and building device attestation or trust tooling at a global scale.
• Strategic relationship builder: Proven ability to leverage collaborative relationships with legal, product, and engineering stakeholders to build trust and accomplish work.

For San Francisco, CA-based roles: The base salary range for this role is USD $232,000 per year - USD $258,000 per year.

For Seattle, WA-based roles: The base salary range for this role is USD $232,000 per year - USD $258,000 per year.

For Sunnyvale, CA-based roles: The base salary range for this role is USD $232,000 per year - USD $258,000 per year.

For all US locations, you will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.

Ready to Ride?

This isn't the kind of place where you follow a playbook - it's where you help write one. If you're driven by impact, energized by challenge, and ready to shape how the world moves - we'd love to hear from you.

You may be eligible for bonuses, equity, and other compensation, as well as a range of benefits. Explore our benefits.

Offices remain key to collaboration and Uber's culture. Unless approved for full remote work, employees must spend at least 50% of their time in-office. Some roles, like those at greenlight hubs, require full-time in-office presence. Ask your Recruiter for details about this role's requirements.

Uber is proud to be an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires accommodation, please let us know by completing this form.