Security Engineer

Job Description

Job Description

Job Title: Security Engineer
Location: Sunnyvale, CA/Seattle, WA (Hybrid)
Duration: 06+ months

Description
Contract Security Engineer — Security & Privacy Reviews

About the role
As a contract Security Engineer on Uber’s Security Review Team, you will proactively identify and reduce security and privacy risks across critical services, third-party platforms, and emerging AI technologies. Your primary focus will be reviewing engineering proposals and ERDs, building automation to scale security assessments, and conducting hands-on adversarial testing of AI agents. You will partner with engineering, security, and privacy teams to turn findings into practical design improvements and reusable security controls.

What you’ll do
-Conduct ERD security and privacy reviews: Evaluate engineering proposals, architecture, and data flows across applications, APIs, cloud infrastructure, and AI systems. Identify risks involving authentication, authorization, sensitive data handling, data minimization, retention, and third-party sharing.
-Perform threat modeling: Identify potential abuse cases and attack paths, recommend mitigations, and work with engineering teams to address risks before deployment.
-Assess and test AI agents: Evaluate third-party and internally developed coding and work-focused agents through adversarial testing. Examine prompt injection, tool use, permissions, data access, sensitive data exposure, and external integrations.
-Build security automation: Develop tools and AI-assisted workflows to streamline ERD reviews, threat modeling, evidence collection, and security testing, increasing assessment coverage and consistency.
-Conduct targeted penetration testing: Validate security assumptions and identify exploitable vulnerabilities in critical services, applications, APIs, and AI agents.
-Drive remediation and share knowledge: Communicate actionable findings, validate fixes, and develop guidance that helps teams prevent recurring security and privacy issues.

Required qualifications
-5+ years of relevant professional experience, including 3+ years in security engineering or a related security role.
-Experience conducting security design reviews, threat modeling, and privacy risk assessments.
-Hands-on penetration testing experience and a strong understanding of application, API, cloud, and data security.
-Software development or scripting experience, with the ability to build tools and automate security workflows.
-Familiarity with AI agent architectures and risks involving prompt injection, tool execution, permissions, and data access.
-Strong written and verbal communication skills, including the ability to explain risks and recommend practical mitigations.
-Ability to work independently with minimal supervision and collaborate across engineering, security, and privacy teams.
-Bachelor’s or master’s degree in computer science, cybersecurity, or a related field, or equivalent practical experience.

Preferred qualifications
-Experience assessing AI agents, LLM applications, or third-party AI platforms.
-Experience building AI-powered security review or testing automation.
-Experience evaluating vendor security readiness and handling sensitive or business-critical data.
-Relevant security certifications, such as OSCP or CISSP.
-A passion for learning, teaching, and improving security practices.

Flexible work from home options available.