About the RoleUber's Tech Risk and Assurance team, part of Engineering Security, helps Uber understand its cybersecurity risk, decide what to do about it, and prove that controls work. Our goal is to make every experience with Uber simple, secure, and safe for riders, eaters, drivers, and partners.
As a Senior Security Technologist, GRC, you will run key parts of Uber's cyber risk management program: risk intake and assessment, risk treatment and acceptance decisions, and the reporting leaders use to see where risk sits and what has been decided. You will partner with engineering, security, audit, privacy, and compliance teams to turn control gaps, threat context, and regulatory requirements into treatment plans that engineering teams can execute, and follow those plans through to closure.
This role combines risk judgment with hands-on technical skill. You will be comfortable reading architecture and design documents, querying data, and building automation on GRC platforms and workflow tools so that risk processes scale without adding manual work. You will work within program goals set with senior leadership and own the design and delivery of the components assigned to you.
What You'll Do- Own cyber risk intake, triage, and prioritization for your program area, so that each risk has a clear owner, a well-formed risk statement, and a timely treatment decision.
- Lead risk assessments, including annual and targeted assessments of systems, applications, and new business areas, and present results with clear recommendations.
- Run the risk exception and acceptance workflow. Confirm that requests have the right context, route them to the right approver, track conditions and expiry dates, and escalate decisions that exceed delegated authority or risk tolerance.
- Partner with engineering teams to define risk treatment plans, identify sustainable fixes, and drive mitigation to the last mile rather than stopping at documentation.
- Contribute to control design reviews and risk decisions that require judgment, stakeholder alignment, and trade-off management.
- Own the roadmap and delivery of one or more components of Uber's risk and compliance tooling. Gather requirements from partner teams, write technical specifications, and work with engineers to ship releases in an Agile delivery model.
- Configure and improve workflows on GRC platforms such as ServiceNow eGRC and Jira, including forms, business rules, client scripts, UI actions, and automation rules.
- Build automation that removes manual steps from risk workflows using Python, SQL, platform APIs, workflow tools, and approved AI tools. Examples include routing approvals, expiring acceptances, and drafting first-pass risk summaries for human review.
- Load, transform, and reconcile data between GRC platforms and other systems, and perform system and integration testing with sample and live data.
- Build and maintain risk reporting for leaders and partner teams, including KRIs, exposure trends, acceptance aging, decision status, and escalation triggers. Design dashboards and reports that support program requirements.
- Prepare material for risk governance forums, including decision papers that set out the risk, the options, and a recommendation.
- Improve risk workflows through better tooling, clearer operating models, and reusable knowledge assets such as runbooks and templates.
- Mentor and onboard analysts and junior team members on risk analysis, risk statement quality, treatment planning, and stakeholder communication.
Basic Qualifications- Bachelor's degree in Computer Science, Computer Engineering, Information Systems, Cybersecurity, Risk Management, or a related field, or equivalent practical experience.
- 5+ years of experience in security, cyber risk, GRC, assurance, security operations, or related technical risk roles.
- Experience running parts of a security risk program end to end, including risk assessments, treatment decisions, and cross-functional follow-through.
- Strong understanding of security controls and risk treatment, with the technical fluency to work with engineers on implementation details in areas such as identity and access, cloud infrastructure, logging, vulnerability management, and secure configuration.
- Hands-on automation experience, including scripting in Python or a similar language, querying data with SQL, and using APIs or workflow tools to automate a process.
- Knowledge of control frameworks and standards such as NIST CSF, NIST 800-53, ISO 27001, SOC 2, and CIS.
- Experience working across multiple stakeholders, handling ambiguity, and driving accountability with limited supervision.
- Excellent written and verbal communication skills, including presenting risk, status, and decision points to director-level and technical audiences.
Preferred Qualifications- Security or audit certifications such as CISA, CISSP, CISM, CRISC, or ISO 27001 Lead Auditor.
- Hands-on experience with the ServiceNow eGRC platform, including configuration, workflow development, and integration.
- Experience with other GRC or ERM tools such as AuditBoard, Archer, OpenPages,Vanta or SAP GRC.
- Experience applying AI or LLM tools to risk work, such as summarizing evidence, classifying findings, or drafting assessments, with appropriate human review.
- Experience with risk quantification methodologies and risk lifecycle tooling.
- Experience building dashboards in tools such as Tableau, Looker, or ServiceNow Performance Analytics.
- Big 4 accounting firm and/or internet or technology industry experience.
- Process management experience, including process redesign and optimization.
- Track record of driving security risk treatment to closure across multiple engineering teams.
- Ability to thrive in environments of uncertainty.
For Seattle, WA-based roles: The base salary range for this role is USD $180,000 per year - USD $200,000 per year.
You will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.
Ready to Ride? This isn't the kind of place where you follow a playbook - it's where you help write one. If you're driven by impact, energized by challenge, and ready to shape how the world moves - we'd love to hear from you.
You may be eligible for bonuses, equity, and other compensation, as well as a range of benefits. Explore our benefits.
Offices remain key to collaboration and Uber's culture. Unless approved for full remote work, employees must spend at least 50% of their time in-office. Some roles, like those at greenlight hubs, require full-time in-office presence. Ask your Recruiter for details about this role's requirements.
Uber is proud to be an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires accommodation, please let us know by completing this form.
