SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 171,000 - 190,000 / annual
As a member of Uber's Security Review Team, you will work across multiple security disciplines to proactively identify and reduce risk in Uber's most critical services and emerging technologies. This role combines deep technical security expertise with an automation-first mindset, helping evolve traditional point-in-time security assessments toward continuous, scalable security testing across Uber's technology ecosystem.
Key responsibilities include:
- Conduct security design reviews and threat modeling across Uber's diverse codebase, evaluating security risks in services, applications, APIs, infrastructure, mobile platforms, AI systems, and production software
- Assess third-party AI agents through adversarial testing to identify security risks in agent behavior, tool use, data access, permissions, prompt injection, and external integrations
- Perform hands-on penetration testing of critical Uber services, applications, APIs, infrastructure, and AI agents to identify exploitable vulnerabilities and complex attack paths
- Design and build AI-powered automation for security design reviews, threat modeling, and penetration testing to increase scale, frequency, and depth of offensive security assessments
- Partner with engineering and security teams to translate offensive security findings into systemic improvements and eliminate vulnerability classes
- Perform multi-disciplinary security design reviews of engineering proposals, analyzing cloud, infrastructure, application, and data-layer security
- Collaborate with engineering teams across the company to analyze design documents and identify potential flaws before production
- Conduct comprehensive security assessments including threat modeling for web and mobile applications
- Champion engineering best practices and serve as a security ambassador
The environment is fast-moving with constantly evolving threats. You will navigate the reality of hybrid cloud and distributed systems, conducting technical security design reviews as part of the secure software development lifecycle. This role requires a technically curious engineer who thrives in ambiguity, takes extreme ownership, and has the grit to stay ahead of sophisticated adversaries.
REQUIREMENTS:
Basic Qualifications:
- 3+ years of professional experience in security engineering, systems architecture, or related software engineering field
- Proven ability to analyze complex system designs and provide technical input to solve security challenges with multiple dependencies
- Broad knowledge of threat modeling, vulnerability classification, and risk modeling frameworks
- Experience with security designs related to cloud-native services, microservices, or distributed systems
- Bachelor's degree in Computer Science, Engineering, or equivalent practical experience
Preferred Qualifications:
- Hands-on experience performing security design reviews and threat modeling across complex applications, services, APIs, distributed systems, cloud infrastructure, and mobile platforms
- Demonstrated ability to identify complex attack paths and systemic security weaknesses by reasoning across application, infrastructure, identity, data, and trust boundaries
- Experience conducting code-assisted security reviews using source code to validate architectural assumptions, security controls, data flows, authorization boundaries, and vulnerabilities
- Experience reviewing large-scale distributed and cloud-native architectures including microservices, service-to-service authentication, APIs, messaging systems, data stores, and multi-cloud environments
- Advanced proficiency in at least one backend language such as Go, Java, or Python to evaluate code-level security
- Hands-on experience with multi-cloud environments (AWS, GCP) and data store technologies (SQL or NoSQL)
- Experience applying AI/LLMs, agents, or automation frameworks to security testing, vulnerability discovery, threat modeling, or other security engineering workflows
- Strong systems thinking with ability to simplify complex technical concepts and influence without authority
- Experience working within automated CI/CD environments or mature Secure Software Development Lifecycle (S-SDLC)
