Security Engineer

Job Title: Security Engineer

Location: Sunnyvale, CA/Seattle, WA (Hybrid)

Duration: 06+ months

Description

Contract Security Engineer — Security & Privacy Reviews

About the role

As a contract Security Engineer on Uber’s Security Review Team, you will proactively identify and reduce security and privacy risks across critical services, third-party platforms, and emerging AI technologies. Your primary focus will be reviewing engineering proposals and ERDs, building automation to scale security assessments, and conducting hands-on adversarial testing of AI agents. You will partner with engineering, security, and privacy teams to turn findings into practical design improvements and reusable security controls.

What you’ll do

-Conduct ERD security and privacy reviews: Evaluate engineering proposals, architecture, and data flows across applications, APIs, cloud infrastructure, and AI systems. Identify risks involving authentication, authorization, sensitive data handling, data minimization, retention, and third-party sharing.

-Perform threat modeling: Identify potential abuse cases and attack paths, recommend mitigations, and work with engineering teams to address risks before deployment.

-Assess and test AI agents: Evaluate third-party and internally developed coding and work-focused agents through adversarial testing. Examine prompt injection, tool use, permissions, data access, sensitive data exposure, and external integrations.

-Build security automation: Develop tools and AI-assisted workflows to streamline ERD reviews, threat modeling, evidence collection, and security testing, increasing assessment coverage and consistency.

-Conduct targeted penetration testing: Validate security assumptions and identify exploitable vulnerabilities in critical services, applications, APIs, and AI agents.

-Drive remediation and share knowledge: Communicate actionable findings, validate fixes, and develop guidance that helps teams prevent recurring security and privacy issues.

Required qualifications

-5+ years of relevant professional experience, including 3+ years in security engineering or a related security role.

-Experience conducting security design reviews, threat modeling, and privacy risk assessments.

-Hands-on penetration testing experience and a strong understanding of application, API, cloud, and data security.

-Software development or scripting experience, with the ability to build tools and automate security workflows.

-Familiarity with AI agent architectures and risks involving prompt injection, tool execution, permissions, and data access.

-Strong written and verbal communication skills, including the ability to explain risks and recommend practical mitigations.

-Ability to work independently with minimal supervision and collaborate across engineering, security, and privacy teams.

-Bachelor’s or master’s degree in computer science, cybersecurity, or a related field, or equivalent practical experience.

Preferred qualifications

-Experience assessing AI agents, LLM applications, or third-party AI platforms.

-Experience building AI-powered security review or testing automation.

-Experience evaluating vendor security readiness and handling sensitive or business-critical data.

-Relevant security certifications, such as OSCP or CISSP.

-A passion for learning, teaching, and improving security practices.

Flexible work from home options available.