Base Salary
$267k - $297k/yr
Responsibilities
- Build source-code, dependency, artifact, container, provenance, and deployment-pipeline protections for the software supply chain.
- Develop dependency inventory, SBOM, vulnerability detection, malicious-package detection, automated remediation, and verification systems.
- Deliver scalable application security platforms incorporating SAST, DAST, SCA, secrets detection, and AI-powered analysis into developer workflows.
- Translate threat models into secure defaults, reusable libraries, architectural improvements, and regression tests.
- Build automated penetration testing, attack orchestration, exploit validation, and continuous offensive security systems.
- Assess AI agents, LLM integrations, MCP servers, and agent tools for prompt injection, tool poisoning, unauthorized execution, data exposure, and trust-boundary violations.
- Write, test, deploy, and operate reliable distributed services while defining architectures, APIs, interfaces, safety controls, and engineering standards.
- Lead cross-team technical initiatives, mentor senior engineers, conduct design and code reviews, and measure security coverage, adoption, remediation, productivity, and risk reduction.
Requirements
- 10+ years of experience in software engineering, security engineering, or related technical fields, including designing, coding, testing, deploying, and operating complex production systems.
- Advanced proficiency in Go, Java, Python, C++, or a comparable programming language.
- Experience building large-scale distributed systems, developer platforms, security services, or infrastructure, with strong data structures, algorithms, concurrency, system design, API, and software architecture fundamentals.
- Deep understanding of source control, build systems, dependency management, CI/CD, containers, cloud-native deployment, application security, software supply chain security, or DevSecOps.
- Strong knowledge of secure design, authentication, authorization, trust boundaries, OWASP Top 10, injection, business logic flaws, and multi-step attacks.
- Expert-level experience in penetration testing, vulnerability research, exploit development, application testing, adversarial testing, scanners, exploitation frameworks, DAST, or automated validation.
- Strong network, cloud, and infrastructure security fundamentals, with familiarity with microservices, Kubernetes, distributed applications, and cloud-native architectures.
- Demonstrated ability to independently lead ambiguous, cross-team initiatives from problem definition through long-term operation and establish technical direction without direct authority.
- Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or a related technical field, or equivalent practical experience.
- Preferred: expertise in SBOMs, software provenance, dependency integrity, cryptographic signing, SLSA, Sigstore, in-toto, OpenSSF, CI/CD architecture, artifact repositories, container registries, deployment orchestration, and automated policy enforcement.
- Preferred: experience with JFrog Artifactory, Jenkins, GitHub Actions, GitLab CI/CD, Buildkite, CircleCI, Argo CD, Kubernetes, and cloud infrastructure.
- Preferred: experience building security analysis engines, SAST, DAST, SCA, secrets scanning, secure code analysis, automated remediation, penetration testing frameworks, exploitation engines, and attack orchestration.
- Preferred: familiarity with Burp Suite, Nuclei, OWASP ZAP, Metasploit, Invicti, or comparable tools.
- Preferred: experience building AI-powered security systems with LLMs, frontier or cybersecurity-focused models, autonomous agents, multi-agent architectures, runtime verification, and human review.
- Preferred: experience red-teaming AI agents, LLM applications, MCP servers, tools, and third-party integrations, including prompt injection, tool poisoning, privilege escalation, data exfiltration, live endpoint testing, and isolated execution.
Benefits
- Base salary is USD $267,000-$297,000 per year for Seattle, WA and Sunnyvale, CA-based roles.
- Eligible full-time employees may participate in Uber’s bonus program and may be offered equity and other compensation.
- Eligible full-time employees can participate in a 401(k) plan and receive various benefits.
- The posting covers Seattle, WA and Sunnyvale, CA-based roles, as well as other US locations.
Tech Stack
Categories
About Uber
We are Uber. The go-getters. The kind of people who are relentless about our mission to help people go anywhere and get anything and earn their way. Movement is what we power. It’s our lifeblood. It runs through our veins. It’s what gets us out of bed each morning. It pushes us to constantly reimagine how we can move better. For you. For all the places you want to go. For all the things you want to get. For all the ways you want to earn. Across the entire world. In real time. At the incredible speed of now. The idea for Uber was born on a snowy night in Paris in 2008, and ever since then our DNA of reimagination and reinvention carries on. We’ve grown into a global platform powering flexible earnings and the movement of people and things in ever expanding ways. We’ve gone from connecting rides on 4 wheels to 2 wheels to 18-wheel freight deliveries. From takeout meals to daily essentials to prescription drugs to just about anything you need at any time and earning your way. From drivers with background checks to real-time verification, safety is a top priority every single day. At Uber, the pursuit of reimagination is never finished, never stops, and is always just beginning.