Join Uber’s Security Review Team to strengthen the security of critical services and AI systems through design reviews, threat modeling, and hands-on offensive security testing, supported by AI-powered automation.
Location
Sunnyvale, CA (onsite)
Compensation
Salary range: USD 171,000 - 190,000 per year.
For all US locations: you will be eligible to participate in Uber’s bonus program, may be offered an equity award and other types of comp, and all full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.
About the Role
In this role, you will conduct security design reviews and threat modeling across Uber’s diverse codebase and AI agents. You will validate attack paths through hands-on penetration testing and help scale offensive security assessments by designing and building AI-powered automation.
Responsibilities
- Conduct security design reviews and threat modeling across Uber’s services, applications, APIs, infrastructure, mobile platforms, AI systems, and other production software.
- Evaluate third-party AI agents, including coding and work-focused agents, using adversarial testing to identify security risks related to agent behavior, tool use, data access, permissions, prompt injection, and external integrations.
- Perform hands-on penetration testing of critical Uber services, applications, APIs, infrastructure, and AI agents to find exploitable vulnerabilities and complex attack paths.
- Design and build AI-powered automation for security design reviews, threat modeling, and penetration testing to increase the scale, frequency, and depth of Offensive Security assessments.
- Partner with engineering and security teams to convert offensive security findings into systemic improvements, helping eliminate vulnerability classes and strengthen security controls across Uber’s technology ecosystem.
- Lead multi-disciplinary security design reviews of engineering proposals, assessing cloud, infrastructure, application, and data-layer security.
- Navigate security design trade-offs and deliver corrective guidance that improves Uber’s overall security posture.
- Collaborate with engineering teams to review design documents and identify potential issues before production.
- Translate technical security findings into actionable guidance for engineering teams and non-technical stakeholders.
- Run comprehensive security assessments, including threat modeling for web and mobile applications, to identify and mitigate risks at scale.
- Serve as a security ambassador and champion engineering best practices to help teams move fast with integrity and care.
Minimum Requirements
- 3+ years of professional experience in security engineering, systems architecture, or a related software engineering field.
- Proven ability to analyze complex system designs and provide technical input to solve security challenges with multiple dependencies.
- Broad knowledge of threat modeling, vulnerability classification, and risk modeling frameworks.
- Experience with security designs for cloud-native services, microservices, or distributed systems.
- Bachelor’s degree in Computer Science, Engineering, or equivalent practical experience.
Technologies
Go, Java, Python, AWS, GCP, SQL, NoSQL, AI/LLMs, CI/CD, microservices, cloud-native services, distributed systems, multi-cloud environments
Preferred Qualifications
- Hands-on experience performing security design reviews and threat modeling across complex applications, services, APIs, distributed systems, cloud infrastructure, and mobile platforms.
- Ability to identify complex attack paths and systemic security weaknesses across application, infrastructure, identity, data, and trust boundaries.
- Experience conducting code-assisted security reviews to validate architectural assumptions, security controls, data flows, authorization boundaries, and potential vulnerabilities.
- Experience reviewing large-scale distributed and cloud-native architectures, including microservices, service-to-service authentication, APIs, messaging systems, data stores, and multi-cloud environments.
- Advanced proficiency in at least one backend language such as Go, Java, or Python for code-level security evaluation.
- Hands-on experience with multi-cloud environments (AWS, GCP) and data store technologies (SQL or NoSQL).
- Experience applying AI/LLMs, agents, or automation frameworks to security testing, vulnerability discovery, threat modeling, or other security engineering workflows.
- Strong systems thinking to simplify complex technical concepts and influence without authority.
- Experience working within an automated CI/CD environment or a mature Secure Software Development Lifecycle (S-SDLC).
Office Location / Remote Work Requirements
- Unless approved for full remote work, employees must spend at least 50% of their time in-office.
- Some roles, such as those at greenlight hubs, require full-time in-office presence.
