Software Engineer II - Security Review Automation

Uber’s Offensive Security team builds security tools, platforms, and AI-powered automation that enable continuous, scalable security testing and risk reduction. If you want to work on systems that support global teams and high-load production environments, this role focuses on turning security expertise into platforms integrated across CI/CD and developer workflows.

This Software Engineer II role is based in Seattle, WA (onsite), with a base salary range of USD 171,000 - 190,000 per year.

What you’ll do

• Build software platforms and automation across SAST, DAST, SCA, penetration testing, AI red teaming, security design reviews, and threat modeling.
• Develop AI-powered agents and workflows that analyze source code and technical designs, orchestrate assessments, generate test cases, and validate findings.
• Partner with security engineers to translate expertise into repeatable, scalable capabilities.
• Build and scale foundational infrastructure and data pipelines, balancing technical debt and shifting priorities while keeping long-term impact in view.
• Integrate security capabilities with source control, CI/CD pipelines, service inventories, and issue-tracking systems to support continuous and on-demand testing.
• Create shared services for assessment orchestration, findings normalization and deduplication, and remediation tracking to reduce duplicate findings and manual effort.
• Design, develop, and maintain high-quality code for features of moderate complexity across projects with multiple dependencies.
• Develop evaluation frameworks and operational safeguards for AI-driven security workflows, measuring accuracy, coverage, latency, and cost, and enforcing access controls, execution boundaries, and auditability.
• Own the software lifecycle end-to-end, from drafting design docs to debugging production issues and managing incidents independently.
• Collaborate across disciplines, including Product, Data Science, and Ops, to convert ambiguous inputs into clear system designs.
• Support engineering best practices through quality code reviews, comprehensive tests, and improvements to system performance.
• Navigate internal complexity and stakeholder inquiries to unblock dependencies and help ensure reliability of the production environment.

What you’ll need

• 3+ years of professional software engineering experience in backend development, distributed systems, or data engineering.
• Proficiency in one or more object-oriented or functional programming languages (for example: Go, Java, Python, or C++).
• Experience with data modeling, query optimization, and translating customer problems into system design.
• Bachelor’s Degree (or equivalent experience) in Computer Science, Engineering, or a related technical field.
• Experience writing tests to verify functionality and establishing monitoring to ensure code stability.
• Experience building APIs, service integrations, or automated workflows that connect multiple systems in production.
• Understanding of secure software development fundamentals, including authentication, authorization, data protection, and safe handling of credentials.
• Familiarity with source control, CI/CD, and automated testing practices for reliable delivery.

Technologies you may work with

Go, Java, Python, C++, SAST, DAST, SCA, CI/CD, Spark, Flink, Kafka, LLMs

Compensation and benefits

• Eligible to participate in Uber’s bonus program (for all US locations).
• May be offered an equity award and other types of comp.
• All full-time employees are eligible to participate in a 401(k) plan.
• Various benefits (details not provided).

About the team

As part of Uber’s Offensive Security team, you’ll build the security tools, platforms, and AI-powered automation that support security testing and risk reduction at Uber scale. The work involves handling messy, global systems, making smart decisions with imperfect information, owning outcomes end-to-end, and maintaining reliability when systems are under heavy load.

Preferred qualifications

• Experience building agentic security workflows that gather technical context, reason across multiple data sources, invoke security tools, validate conclusions, and produce evidence-backed assessments.
• Experience applying frontier LLMs to complex security reasoning, including architecture analysis, attack-path identification, threat enumeration, vulnerability discovery, and security control validation.
• Experience developing multi-agent or multi-model architectures, including specialized agents, model routing, or model-as-judge techniques.
• Experience identifying and reducing code-level technical debt in high-load distributed systems.
• Background in mentoring new team members and contributing to engineering culture.
• Proficiency with Big Data frameworks (for example: Spark, Flink) or real-time streaming (for example: Kafka).
• Demonstrated ability to exercise sound judgment on engineering trade-offs for complex systems.
• Experience building security tools or automation in domains such as SAST, DAST, SCA, penetration testing, AI red teaming, security design reviews, or threat modeling.
• Experience developing LLM-powered applications or agentic workflows, including model integration, tool execution, context retrieval, and orchestration.
• Experience building evaluation frameworks for AI-driven systems, including reproducible benchmarks, regression testing, and output quality and reliability measurement.
• Familiarity with source-code analysis, dependency graphs, API testing, or isolated execution environments for automated security testing.
• Experience using AI-assisted development tools to accelerate software implementation, testing, debugging, and maintenance.

Work location and onsite expectations

• Unless approved for full remote work, employees must spend at least 50% of their time in-office.
• Some roles may require full-time in-office presence.