Security Engineer II - Design Review

Responsibilities

• Conduct security design reviews and threat modeling across services, applications, APIs, infrastructure, mobile platforms, AI systems, and production software.
• Perform adversarial testing of third-party AI agents, including analysis of tool use, data access, permissions, prompt injection, and external integrations.
• Conduct hands-on penetration testing to identify exploitable vulnerabilities and complex attack paths.
• Design and build AI-powered automation for security reviews, threat modeling, and penetration testing.
• Partner with engineering and security teams to convert offensive security findings into systemic improvements and stronger controls.
• Review cloud, infrastructure, application, and data-layer security in engineering proposals and provide corrective guidance.
• Analyze design documents and identify security flaws before systems reach production.
• Communicate technical findings to engineering and non-technical stakeholders and promote secure engineering practices.

Requirements

• At least 3 years of professional experience in security engineering, systems architecture, or a related software engineering field.
• Ability to analyze complex system designs and provide technical input on security challenges with multiple dependencies.
• Broad knowledge of threat modeling, vulnerability classification, and risk modeling frameworks.
• Experience with security designs for cloud-native services, distributed systems, or related architectures.
• Bachelor’s degree in Computer Science, Engineering, or equivalent practical experience.
• Preferred: experience with security design reviews, threat modeling, penetration testing, and complex attack-path analysis.
• Preferred: experience with code-assisted security reviews and large-scale distributed or cloud-native architectures.
• Preferred: advanced proficiency in at least one backend language such as Go, Java, or Python.
• Preferred: experience with AWS or GCP and SQL or NoSQL data stores.
• Preferred: experience applying AI, LLMs, agents, or automation frameworks to security testing and vulnerability discovery.
• Preferred: experience with automated CI/CD environments or mature Secure Software Development Lifecycles.

Benefits

• Base salary is USD $171,000–$190,000 per year for roles based in San Francisco, Seattle, or Sunnyvale.
• Eligibility for Uber’s bonus program and potential equity awards or other compensation.
• 401(k) plan eligibility for full-time employees.
• Various employee benefits are available.