Sr Staff Security Engineer - Engineer

Senior Staff Security Engineer - Supply Chain, Offensive & AI Security

About this role and team

As a Senior Staff Security Engineer, you will define and build security platforms, developer tooling, and AI-powered automation that protect Uber’s software ecosystem at scale. Securing the software supply chain will be a core focus, alongside continuous offensive testing and security assessments of AI applications and autonomous agents.

This is a deeply technical, hands-on role. You will write production-quality code to protect source code, dependencies, build infrastructure, artifacts, and deployment pipelines. You will also build systems that automate penetration testing, vulnerability discovery and validation, adversarial AI testing, and remediation. Your work will advance both the use of AI to improve security and the security of AI itself, including first-party and third-party agents, LLM integrations, Model Context Protocol (MCP) servers, and autonomous workflows.

Working across Security, Developer Infrastructure, and Engineering, you will establish technical strategy and lead complex initiatives from concept through deployment and long-term operation. You will embed controls into developer workflows, turn manual assessments into continuous capabilities, and eliminate systemic weaknesses through secure defaults and platform improvements.

Successful candidates combine expert software engineering with deep expertise in securing software delivery and offensive security. They build scalable systems that reduce real-world risk while improving developer productivity.

What you’ll do

• Build software supply chain protections. Implement source code integrity, commit signing, code, artifact, and container signing, provenance verification, dependency integrity, and cryptographic verification. Establish standards and automated enforcement for secure builds, artifact repositories, container registries, and deployment pipelines that prevent untrusted code, unsigned artifacts, vulnerable dependencies, and noncompliant software from advancing.
• Engineer dependency security and remediation systems. Build capabilities to inventory and assess open-source components, manage SBOMs, detect vulnerable or malicious packages and transitive dependency risks, and mitigate supply chain compromise. Automate dependency upgrades, secure patches, code fixes, and verification of remediation effectiveness.
• Deliver scalable application security platforms. Integrate SAST, DAST, SCA, secrets detection, and AI-powered analysis into code generation, development, pull requests, and CI/CD. Analyze source code, build configurations, infrastructure definitions, containers, and artifacts at scale, and provide actionable feedback with minimal developer friction.
• Turn threat models into engineering controls. Model threats across applications, APIs, identity systems, build infrastructure, cloud environments, and AI workflows. Identify trust boundaries, abuse cases, and attack paths, then implement secure defaults, reusable libraries, architectural improvements, and regression tests that eliminate recurring vulnerability classes.
• Build continuous offensive security capabilities. Develop automated penetration testing, DAST, attack orchestration, and exploit validation systems for applications, APIs, mobile services, infrastructure, and externally accessible endpoints. Identify authorization weaknesses, business logic flaws, privilege escalation, and chained attacks, using isolated execution environments, attack sandboxes, and controls appropriate for production testing.
• Build AI-powered security tools and test AI systems. Apply frontier models, security-specific models, and autonomous agents to discovery, attack planning, validation, secure coding, and remediation. Assess first-party and third-party agents, LLM integrations, MCP servers, and agent tools for prompt injection, tool poisoning, unauthorized execution, data exposure, and trust boundary violations.
• Make findings accurate and actionable. Correlate and deduplicate findings, combine deterministic analysis with AI reasoning, dynamic testing, exploit verification, and human review, and prioritize validated risk. Continuously reassess applications and agents as code, configurations, models, tools, and integrations change.
• Own production engineering and technical direction. Write maintainable, tested code; define architectures, APIs, interfaces, safety controls, and engineering standards; and operate reliable distributed services. Evaluate emerging technologies, prototype quickly, and lead initiatives across teams with clear milestones and measurable outcomes.
• Raise engineering quality and adoption. Mentor senior engineers, lead design and code reviews, and partner with infrastructure and product teams to embed security into existing workflows. Communicate investment priorities and measure improvements in coverage, accuracy, remediation, developer adoption, productivity, and risk reduction.

Basic qualifications

• Production software engineering: 10+ years of experience in software engineering, security engineering, or related technical fields, including significant experience designing, coding, testing, deploying, and operating complex production systems. Advanced proficiency in Go, Java, Python, C++, or a comparable language.
• Systems architecture: Experience building large-scale distributed systems, developer platforms, security services, or infrastructure, supported by strong fundamentals in data structures, algorithms, APIs, concurrency, system design, and software architecture.
• Secure software delivery: Deep understanding of source control, build systems, dependency management, CI/CD, containers, and cloud-native deployment, with experience implementing automated controls in developer workflows. Expert-level depth in application security, software supply chain security, or DevSecOps.
• Application security and threat modeling: Strong understanding of secure design, authentication, authorization, trust boundaries, and application and API vulnerabilities, including OWASP Top 10, injection, business logic flaws, and multi-step attacks. Ability to translate threat models and security findings into concrete engineering changes.
• Offensive security engineering: Expert-level depth in penetration testing, vulnerability research, exploit development, application testing, or adversarial testing, with experience building or integrating scanners, exploitation frameworks, DAST, or automated validation capabilities.
• Infrastructure security: Strong fundamentals in network, cloud, and infrastructure security, and familiarity with microservices, Kubernetes, distributed applications, and modern cloud-native architectures.
• Technical ownership: Demonstrated ability to resolve ambiguous problems and independently lead initiatives across teams from problem definition through implementation and long-term operation, using scalable engineering solutions to address systemic weaknesses.
• Influence and collaboration: Ability to establish technical direction without direct authority, communicate architectural decisions, and work effectively across security and engineering organizations.
• Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or a related technical field, or equivalent practical experience.

Preferred qualifications

• Supply chain integrity and standards: Expertise in SBOMs, software provenance, dependency integrity, code, artifact, and container signing, and cryptographic verification; experience implementing SLSA, Sigstore, in-toto, OpenSSF, or equivalent frameworks and technologies.
• Build and delivery infrastructure: Deep experience with CI/CD architecture, artifact repositories, container registries, deployment orchestration, and automated policy enforcement. Hands-on experience with tools such as JFrog Artifactory, Jenkins, GitHub Actions, GitLab CI/CD, Buildkite, CircleCI, and Argo CD, including integrations with source control, Kubernetes, and cloud infrastructure.
• Security platform development: A record of shipping and operating backend services, analysis engines, and developer infrastructure across large codebases, monorepos, microrepositories, and distributed environments. Expertise in SAST, DAST, SCA, secrets scanning, secure code analysis, and automated remediation through code fixes, dependency updates, patch generation, and verification.
• Threat modeling and secure architecture: Experience leading threat modeling for software delivery systems, applications, APIs, and AI agents, and implementing the resulting mitigations. Deep knowledge of service-to-service authentication, identity, messaging, data stores, containers, Kubernetes, and multi-cloud architectures.
• Offensive automation: Experience building penetration testing frameworks, exploitation engines, attack orchestration, scalable DAST, and systems that generate, execute, and validate exploits in authorized environments. Expertise in web, API, mobile, cloud, and distributed systems testing, attack-path analysis, privilege escalation, and lateral movement; familiarity with Burp Suite, Nuclei, OWASP ZAP, Metasploit, Invicti, or comparable tools.
• AI-powered security engineering: Experience building with LLMs, frontier or cybersecurity-focused models, autonomous agents, or multi-agent architectures for source analysis, reconnaissance, attack planning, vulnerability discovery, exploitability assessment, secure code generation, and remediation. Experience combining deterministic analysis, multi-model reasoning, runtime verification, and human review.
• AI security testing: Experience assessing agents, LLM applications, MCP servers, tools, and third-party integrations for direct and indirect prompt injection, tool poisoning, insecure invocation, privilege escalation, data exfiltration, and cross-agent trust violations. Experience building red teaming frameworks with live endpoint testing, multi-turn adversarial interactions, dynamic validation, and isolated execution infrastructure.
• Developer experience and measurable outcomes: Experience integrating continuous testing and enforcement into development and production workflows while minimizing friction. Ability to measure discovery and exploit validation rates, precision, recall, false positives, remediation, enforcement and attack coverage, automation, adoption, and risk reduction.
• Sustained technical leadership: Experience turning research and prototypes into maintainable production services, setting multi-year technical direction, mentoring senior engineers, and raising standards through architecture guidance and code review.

For Seattle, WA-based roles: The base salary range for this role is USD $267,000 per year - USD $297,000 per year.

For Sunnyvale, CA-based roles: The base salary range for this role is USD $267,000 per year - USD $297,000 per year.

For all US locations, you will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.