Security Engineer II - Design Review / Threat Modelling

About the role

As a member of Uber's Security Review Team, you will work across multiple security disciplines to proactively identify and reduce risk in Uber's most critical services and emerging technologies. You will perform security design reviews and threat modeling for critical services and AI agents, conduct hands-on penetration testing to validate real-world attack paths, and help build AI-powered automation that transforms how these security assessments are performed at scale. This role combines deep technical security expertise with an automation-first mindset, helping evolve traditional point-in-time assessments toward continuous, scalable security testing across Uber's technology ecosystem. This isn't a "set and forget" role. Our environment is fast-moving and the threats are constantly evolving. You will navigate the "messy" reality of hybrid cloud and distributed systems, conducting technical security design reviews as part of our secure software development lifecycle. We are looking for a technically curious engineer who thrives in ambiguity, takes extreme ownership of their work, and has the grit to stay ahead of sophisticated adversaries. If you are motivated by high-stakes challenges and want to build a more secure future for movement - this is where you'll grow. Ready to Ride? This isn't the kind of place where you follow a playbook - it's where you help write one. If you're driven by impact, energized by challenge, and ready to shape how the world moves - we'd love to hear from you.

Responsibilities

• Conduct security design reviews and threat modeling across Uber's diverse codebase, evaluating security risks in services, applications, APIs, infrastructure, mobile platforms, AI systems, and other production software.
• Assess third-party AI agents, including coding and work-focused agents, through adversarial testing to identify security risks in agent behavior, tool use, data access, permissions, prompt injection, and external integrations.
• Perform hands-on penetration testing of critical Uber services, applications, APIs, infrastructure, and AI agents to identify exploitable vulnerabilities and complex attack paths.
• Design and build AI-powered automation for security design reviews, threat modeling, penetration testing, increasing the scale, frequency, and depth of Offensive Security assessments.
• Partner with engineering and security teams to translate offensive security findings into systemic improvements, helping eliminate vulnerability classes and strengthen security controls across Uber's technology ecosystem.
• Perform multi-disciplinary security design reviews of engineering proposals, analyzing cloud, infrastructure, application, and data-layer security.
• Navigate complex design trade-offs to provide corrective guidance that improves the overall security posture of Uber's products and services.
• Collaborate with engineering teams across the company to analyze design documents and identify potential flaws before they reach production.
• Translate technical security findings into