Staff Security Engineer - Detection & Response (AI-Driven Threat Hunting & Incident Response)

About the Role

Our mission is to protect, defend, and secure Uber's products, infrastructure, and data by building highly available, scalable, and extensible security solutions and services. We are seeking a Staff Security Engineer to join the Cyber Defense team to drive the development of our next-generation incident response and threat hunting capabilities, powered by AI/ML/GenAI. In this role, you will be a passionate and pragmatic technologist, designing scalable systems while delivering high-quality code.

You will architect and implement industry-leading response solutions, including autonomous investigation agents and AI-driven threat hunting platforms, to defend Uber at machine speed against sophisticated, AI-driven adversaries. As a Staff Engineer, you are not only a technical role model but also an empathic leader and humble teacher, mentoring a team of passionate engineers while delivering uniquely challenging projects.

---- What the Candidate Will Do ----

• Agentic Incident Response: Architect and build autonomous security agents that investigate, triage, contain, and remediate incidents end-to-end, achieving response at machine speed and dramatically reducing mean-time-to-respond.
• AI-Driven Threat Hunting: Design and lead proactive, hypothesis-driven hunting campaigns across cloud, host, network, and application telemetry, and build the platforms and agents that scale hunting from manual expeditions to continuous, automated pursuit of adversaries.
• Investigation & Forensics at Scale: Build the tooling and data pipelines that power deep investigations and forensics - correlating signals, reconstructing attacker activity, and turning findings into repeatable, automated response playbooks.
• Detection Feedback Loop: Partner with detection engineering to convert hunt findings and incident learnings into higher-fidelity signals, closing the loop between what hunters find and what the platform detects.
• Technical Leadership: Set technical direction for specific projects by identifying priorities, managing expectations, and considering tradeoffs.
• Engineering Excellence: Champion best software engineering practices and empower teams to build a culture of quality and operational excellence.
• Cross-Functional Collaboration: Partner with IT, product, and various security teams to strengthen response readiness and posture across the entire environment.

• BS/MS Degree in Computer Science, Engineering, or a related field.
• 7+ years of industry experience in a software development or security engineering environment.
• Proficiency in programming languages such as Golang, Java, or Python.
• Deep understanding of distributed systems, high-availability, and high-performance system design.
• Hands-on experience with Cyber Defense such as incident response, threat hunting, and investigation.

• Master's Degree or PhD in Computer Science, Engineering, Information Security or a related field.
• Prior experience leading incident response, threat hunting, digital forensics, and building AI-driven response tooling.
• Deep experience incorporating GenAI agents into production security services, specifically for investigation, triage, or automated response.
• In-depth knowledge of security software frameworks, including EDR solutions (e.g., CrowdStrike, SentinelOne) and SIEM platforms (e.g., Splunk, Chronicle).
• Strong understanding of security frameworks and standards (e.g., MITRE ATT&CK, NIST CSF, ISO 27001).