Sr Staff Security Engineer - Engineer

Senior Staff Security Engineer — Supply Chain, Offensive & AI Security

About this role and team

As a Senior Staff Security Engineer, you will define and build security platforms, developer tooling, and AI-powered automation that protect Uber’s software ecosystem at scale. Securing the software supply chain will be a core focus, alongside continuous offensive testing and security assessments of AI applications and autonomous agents.

This is a deeply technical, hands-on role. You will write production-quality code to protect source code, dependencies, build infrastructure, artifacts, and deployment pipelines. You will also build systems that automate penetration testing, vulnerability discovery and validation, adversarial AI testing, and remediation. Your work will advance both the use of AI to improve security and the security of AI itself, including first-party and third-party agents, LLM integrations, Model Context Protocol (MCP) servers, and autonomous workflows.

Working across Security, Developer Infrastructure, and Engineering, you will establish technical strategy and lead complex initiatives from concept through deployment and long-term operation. You will embed controls into developer workflows, turn manual assessments into continuous capabilities, and eliminate systemic weaknesses through secure defaults and platform improvements.

Successful candidates combine expert software engineering with deep expertise in securing software delivery and offensive security. They build scalable systems that reduce real-world risk while improving developer productivity.

What you’ll do

• Build software supply chain protections. Implement source code integrity, commit signing, code, artifact, and container signing, provenance verification, dependency integrity, and cryptographic verification. Establish standards and automated enforcement for secure builds, artifact repositories, container registries, and deployment pipelines that prevent untrusted code, unsigned artifacts, vulnerable dependencies, and noncompliant software from advancing.
• Engineer dependency security and remediation systems. Build capabilities to inventory and assess open-source components, manage SBOMs, detect vulnerable or malicious packages and transitive dependency risks, and mitigate supply chain compromise. Automate dependency upgrades, secure patches, code fixes, and verification of remediation effectiveness.
• Deliver scalable application security platforms. Integrate SAST, DAST, SCA, secrets detection, and AI-powered analysis into code generation, development, pull requests, and CI/CD. Analyze source code, build configurations, infrastructure definitions, containers, and artifacts at scale, and provide actionable feedback with minimal developer friction.
• Turn threat models into engineering controls. Model threats across applications, APIs, identity systems, build infrastructure, cloud environments, and AI workflows. Identify trust boundaries, abuse cases, and attack paths, then implement secure defaults, reusable libraries, architectural improvements, and regression tests that eliminate recurring vulnerability classes.
• Build continuous offensive security capabilities. Develop automated penetration testing, DAST, attack orchestration, and exploit validation systems for applications, APIs, mobile services, infrastructure, and externally accessible endpoints. Identify authorization weaknesses, business logic flaws, privilege escalation, and chained attacks, using isolated execution environments, attack sandboxes, and controls appropriate for production testing.
• Build AI-powered security tools and test AI systems. Apply frontier models, security-specific models, and autonomous agents to discovery, attack planning, validation, secure coding, and remediation. Assess first-party and third-party agents, LLM integrations, MCP servers, and agent tools for prompt injection, tool poisoning, unauthorized execution, data exposure, and trust boundary violations.
• Make findings accurate and actionable. Correlate and deduplicate findings, combine deterministic analysis with AI reasoning, dynamic testing, exploit verification, and human review, and prioritize validated risk. Continuously reassess applications and agents as code, configurations, models, tools, and integrations change.
• Own production engineering and technical direction. Write maintainable, tested code; define architectures, APIs, interfaces, safety controls, and engineering standards; and operate reliable distributed services. Evaluate emerging technologies, prototype quickly, and lead initiatives across teams with clear milestones and measurable outcomes.
• Raise engineering quality and adoption. Mentor senior engineers, lead design and code reviews, and partner with infrastructure and product teams to embed security into existing workflows. Communicate investment priorities and measure improvements in coverage, accuracy, remediation, developer adoption, productivity, and risk reduction.

Basic qualifications

• Production software engineering: 10+ years of experience in software engineering, security engineering, or related technical fields, including significant experience designing, coding, testing, deploying, and operating complex production systems. Advanced proficiency in Go, Java, Python, C++, or a comparable language.
• Systems architecture: Experience building large-scale distributed systems, developer platforms, security services, or infrastructure, supported by strong fundamentals in data structures, algorithms, APIs, concurrency, system design, and software architecture.
• Secure software delivery: Deep understanding of source control, build systems, dependency management, CI/CD, containers, and cloud-native deployment, with experience implementing automated controls in developer workflows. Expert-level depth in application security, software supply chain security, or DevSecOps.
• Application security and threat modeling: Strong understanding of secure design, authentication, authorization, trust boundaries, and application and API vulnerabilities, including OWASP Top 10, injection, business logic flaws, and multi-step attacks. Ability to translate threat models and security findings into concrete engineering changes.
• Offensive security engineering: Expert-level depth in penetration testing, vulnerability research, exploit development, application testing, or adversarial testing, with experience building or integrating scanners, exploitation frameworks, DAST, or automated validation capabilities.
• Infrastructure security: Strong fundamentals in network, cloud, and infrastructure security, and familiarity with microservices, Kubernetes, distributed applications, and modern cloud-native architectures.
• Technical ownership: Demonstrated ability to resolve ambiguous problems and independently lead initiatives across teams from problem definition through implementation and long-term operation, using scalable engineering solutions to address systemic weaknesses.
• Influence and collaboration: Ability to establish technical direction without direct authority, communicate architectural decisions, and work effectively across security and engineering organizations.
• Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or a related technical field, or equivalent practical experience.

Preferred qualifications

• Supply chain integrity and standards: Expertise in SBOMs, software provenance, dependency integrity, code, artifact, and container signing, and cryptographic verification; experience implementing SLSA, Sigstore, in-toto, OpenSSF, or equivalent frameworks and technologies.

…