Security Engineer II - Design Review/Threat Modeling

Uber’s Security Review Team is seeking a Security Engineer II to lead security design reviews and threat modeling across a wide range of Uber services and AI agents. The role combines hands-on offensive security work with AI-powered automation to increase the scale and depth of assessments.

Role Overview

As a Security Engineer II, you will evaluate security risks across Uber’s codebase, including services, applications, APIs, infrastructure, mobile platforms, and AI systems. You will also assess third-party AI agents through adversarial testing and apply offensive security techniques to identify exploitable vulnerabilities and complex attack paths.

Responsibilities

• Conduct security design reviews and threat modeling across Uber’s diverse codebase, evaluating risks in services, applications, APIs, infrastructure, mobile platforms, AI systems, and other production software.
• Assess third-party AI agents, including coding and work-focused agents, through adversarial testing to identify security risks in agent behavior, tool use, data access, permissions, prompt injection, and external integrations.
• Perform hands-on penetration testing of critical Uber services, applications, APIs, infrastructure, and AI agents to identify exploitable vulnerabilities and complex attack paths.
• Design and build AI-powered automation for security design reviews, threat modeling, and penetration testing, increasing the scale, frequency, and depth of Offensive Security assessments.
• Partner with engineering and security teams to translate offensive security findings into systemic improvements, helping eliminate vulnerability classes and strengthen security controls across Uber’s technology ecosystem.
• Perform multi-disciplinary security design reviews of engineering proposals, analyzing cloud, infrastructure, application, and data-layer security.
• Navigate complex design trade-offs to provide corrective guidance that improves the overall security posture of Uber’s products and services.
• Collaborate with engineering teams across the company to analyze design documents and identify potential flaws before they reach production.
• Translate technical security findings into actionable guidance for engineering and non-technical stakeholders to ensure alignment and impact.
• Conduct comprehensive security assessments, including threat modeling for web and mobile applications, to identify and mitigate risks at scale.
• Champion engineering best practices and serve as a security ambassador, helping teams move fast while building with integrity and care.

Required Qualifications

• 3+ years of professional experience in security engineering, systems architecture, or a related software engineering field.
• Proven ability to analyze complex system designs and provide technical input to solve security challenges with multiple dependencies.
• Broad knowledge of threat modeling, vulnerability classification, and risk modeling frameworks.
• Experience with security designs related to cloud-native services, microservices, or distributed systems.
• Bachelor’s degree in Computer Science, Engineering, or equivalent practical experience.

Preferred Qualifications

• Hands-on experience performing security design reviews and threat modeling across complex applications, services, APIs, distributed systems, cloud infrastructure, and mobile platforms.
• Demonstrated ability to identify complex attack paths and systemic security weaknesses by reasoning across application, infrastructure, identity, data, and trust boundaries.
• Experience conducting code-assisted security reviews, using source code to validate architectural assumptions, security controls, data flows, authorization boundaries, and potential vulnerabilities.
• Experience reviewing large-scale distributed and cloud-native architectures, including microservices, service-to-service authentication, APIs, messaging systems, data stores, and multi-cloud environments.
• Advanced proficiency in at least one backend language such as Go, Java, or Python to evaluate code-level security.
• Hands-on experience with multi-cloud environments (e.g., AWS, GCP) and data store technologies (SQL or NoSQL).
• Experience applying AI/LLMs, agents, or automation frameworks to security testing, vulnerability discovery, threat modeling, or other security engineering workflows.
• Strong systems thinking with the ability to simplify complex technical concepts and influence without authority.
• Experience working within an automated CI/CD environment or a mature Secure Software Development Lifecycle (S-SDLC).

Technologies

• Go, Java, Python
• AWS, GCP
• SQL, NoSQL
• AI/LLMs
• CI/CD
• Mobile platforms
• Microservices, distributed systems, cloud-native services
• Multi-cloud environments

Compensation and Location

Location: Seattle, WA (onsite).

Salary: USD 171,000 - 190,000 per year.

For Seattle, WA-based roles: The base salary range for this role is USD $171,000 per year - USD $190,000 per year.

Benefits

• You will be eligible to participate in Uber’s bonus program.
• May be offered an equity award and other types of comp.
• All full-time employees are eligible to participate in a 401(k) plan.
• Various benefits.
• You may be eligible for bonuses, equity, and other compensation, as well as a range of benefits.

Work Arrangement

• Unless approved for full remote work, employees must spend at least 50% of their time in-office.
• Some roles, like those at greenlight hubs, require full-time in-office presence.