As a Senior Staff Security Engineer, you will define and build security platforms, developer tooling, and AI-powered automation that protect Uber's software ecosystem at scale. Securing the software supply chain will be a core focus, alongside continuous offensive testing and security assessments of AI applications and autonomous agents.
This is a deeply technical, hands-on role. You will write production-quality code to protect source code, dependencies, build infrastructure, artifacts, and deployment pipelines. You will also build systems that automate penetration testing, vulnerability discovery and validation, adversarial AI testing, and remediation. Your work will advance both the use of AI to improve security and the security of AI itself, including first-party and third-party agents, LLM integrations, Model Context Protocol (MCP) servers, and autonomous workflows.
Working across Security, Developer Infrastructure, and Engineering, you will establish technical strategy and lead complex initiatives from concept through deployment and long-term operation. You will embed controls into developer workflows, turn manual assessments into continuous capabilities, and eliminate systemic weaknesses through secure defaults and platform improvements.
Successful candidates combine expert software engineering with deep expertise in securing software delivery and offensive security. They build scalable systems that reduce real-world risk while improving developer productivity.
What you'll do
Build software supply chain protections. Implement source code integrity, commit signing, code, artifact, and container signing, provenance verification, dependency integrity, and cryptographic verification. Establish standards and automated enforcement for secure builds, artifact repositories, container registries, and deployment pipelines that prevent untrusted code, unsigned artifacts, vulnerable dependencies, and noncompliant software from advancing.
Engineer dependency security and remediation systems. Build capabilities to inventory and assess open-source components, manage SBOMs, detect vulnerable or malicious packages and transitive dependency risks, and mitigate supply chain compromise. Automate dependency upgrades, secure patches, code fixes, and verification of remediation effectiveness.
Deliver scalable application security platforms. Integrate SAST, DAST, SCA, secrets detection, and AI-powered analysis into code generation, development, pull requests, and CI/CD. Analyze source code, build configurations, infrastructure definitions, containers, and artifacts at scale, and provide actionable feedback with minimal developer friction.
Turn threat models into engineering controls. Model threats across applications, APIs, identity systems, build infrastructure, cloud environments, and AI workflows. Identify trust boundaries, abuse cases, and attack paths, then implement secure defaults, reusable libraries, architectural improvements, and regression tests that eliminate recurring vulnerability classes.
Build continuous offensive security capabilities. Develop automated penetration testing, DAST, attack orchestration, and exploit validation systems for applications, APIs, mobile services, infrastructure, and externally accessible endpoints. Identify authorization weaknesses, business logic flaws, privilege escalation, and chained attacks, using isolated execution environments, attack sandboxes, and controls appropriate for production testing.
Build AI-powered security tools and test AI systems. Apply frontier models, security-specific models, and autonomous agents to discovery, attack planning, validation, secure coding, and remediation. Assess first-party and third-party agents, LLM integrations, MCP servers, and agent tools for prompt injection, tool poisoning, unauthorized execution, data exposure, and trust boundary violations.
Make findings accurate and actionable. Correlate and deduplicate findings, combine deterministic analysis with AI reasoning, dynamic testing, exploit verification, and human review, and prioritize validated risk. Continuously reassess applications and agents as code, configurations, models, tools, and integrations change.
Own production engineering and technical direction. Write maintainable, tested code; define architectures, APIs, interfaces, safety controls, and engineering standards; and operate reliable distributed services. Evaluate emerging technologies, prototype quickly, and lead initiatives across teams with clear milestones and measurable outcomes.
Raise engineering quality and adoption. Mentor senior engineers, lead design and code reviews, and partner with infrastructure and product teams to embed security into existing workflows. Communicate investment priorities and measure improvements in coverage, accuracy, remediation, developer adoption, productivity, and risk reduction.
Basic qualifications
Production software engineering: 10+ years of experience in software engineering, security engineering, or related technical fields, including significant experience designing, coding, testing, deploying, and operating complex production systems. Advanced proficiency in Go, Java, Python, C++, or a comparable language.
Systems architecture: Experience building large-scale distributed systems, developer platforms, security services, or infrastructure, supported by strong fundamentals in data structures, algorithms, APIs, concurrency, system design, and software architecture.
Secure software delivery: Deep understanding of source control, build systems, dependency management, CI/CD, containers, and cloud-native deployment, with experience implementing automated controls in developer workflows. Expert-level depth in application security, software supply chain security, or DevSecOps.
Application security and threat modeling: Strong understanding of secure design, authentication, authorization, trust boundaries, and application and API vulnerabilities, including OWASP Top 10, injection, business logic flaws, and multi-step attacks. Ability to translate threat models and security findings into concrete engineering changes.
Offensive security engineering: Expert-level depth in penetration testing, vulnerability research, exploit development, application testing, or adversarial testing, with experience building or integrating scanners, exploitation frameworks, DAST, or automated validation capabilities.
Infrastructure security: Strong fundamentals in network, cloud, and infrastructure security, and familiarity with microservices, Kubernetes, distributed applications, and modern cloud-native architectures.
Technical ownership: Demonstrated ability to resolve ambiguous problems and independently lead initiatives across teams from problem definition through implementation and long-term operation, using scalable engineering solutions to address systemic weaknesses.
Influence and collaboration: Ability to establish technical direction without direct authority, communicate architectural decisions, and work effectively across security and engineering organizations.
Bachelor's degree in Computer Science, Engineering, Cybersecurity, or a related technical field, or equivalent practical experience.
Preferred qualifications
Supply chain integrity and standards: Expertise in SBOMs, software provenance, dependency integrity, code, artifact, and container signing, and cryptographic verification; experience implementing SLSA, Sigstore, in-toto, OpenSSF, or equivalent frameworks and technologies.
Build and delivery infrastructure: Deep experience with CI/CD architecture, artifact repositories, container registries, deployment orchestration, and automated policy enforcement. Hands-on experience with tools such as JFrog Artifactory, Jenkins, GitHub Actions, GitLab CI/CD, Buildkite, CircleCI, and Argo CD, including integrations with source control, Kubernetes, and cloud infrastructure.
Security platform development: A record of shipping and operating backend services, analysis engines, and developer infrastructure across large codebases, monorepos, microrepositories, and distributed environments. Expertise in SAST, DAST, SCA, secrets scanning, secure code analysis, and automated remediation through code fixes, dependency updates, patch generation, and verification.
Threat modeling and secure architecture: Experience leading threat modeling for software delivery systems, applications, APIs, and AI agents, and implementing the resulting mitigations. Deep knowledge of service-to-service authentication, identity, messaging, data stores, containers, Kubernetes, and multi-cloud architectures.
Offensive automation: Experience building penetration testing frameworks, exploitation engines, attack orchestration, scalable DAST, and systems that generate, execute, and validate exploits in authorized environments. Expertise in web, API, mobile, cloud, and distributed systems testing, attack-path analysis, privilege escalation, and lateral movement; familiarity with Burp Suite, Nuclei, OWASP ZAP, Metasploit, Invicti, or comparable tools.
AI-powered security engineering: Experience building with LLMs, frontier or cybersecurity-focused models, autonomous agents, or multi-agent architectures for source analysis, reconnaissance, attack planning, vulnerability discovery, exploitability assessment, secure code generation, and remediation. Experience combining deterministic analysis, multi-model reasoning, runtime verification, and human review.
AI security testing: Experience assessing agents, LLM applications, MCP servers, tools, and third-party integrations for direct and indirect prompt injection, tool poisoning, insecure invocation, privilege escalation, data exfiltration, and cross-agent trust violations. Experience building red teaming frameworks with live endpoint testing, multi-turn adversarial interactions, dynamic validation, and isolated execution infrastructure.
Developer experience and measurable outcomes: Experience integrating continuous testing and enforcement into development and production workflows while minimizing friction. Ability to measure discovery and exploit validation rates, precision, recall, false positives, remediation, enforcement and attack coverage, automation, adoption, and risk reduction.
Sustained technical leadership: Experience turning research and prototypes into maintainable production services, setting multi-year technical direction, mentoring senior engineers, and raising standards through architecture guidance and code review.
For Seattle, WA-based roles: The base salary range for this role is USD $267,000 per year - USD $297,000 per year.
For Sunnyvale, CA-based roles: The base salary range for this role is USD $267,000 per year - USD $297,000 per year.
For all US locations, you will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.
Ready to Ride?
This isn't the kind of place where you follow a playbook - it's where you help write one. If you're driven by impact, energized by challenge, and ready to shape how the world moves - we'd love to hear from you.
You may be eligible for bonuses, equity, and other compensation, as well as a range of benefits. Explore our benefits.
Offices remain key to collaboration and Uber's culture. Unless approved for full remote work, employees must spend at least 50% of their time in-office. Some roles, like those at greenlight hubs, require full-time in-office presence. Ask your Recruiter for details about this role's requirements.
Uber is proud to be an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires accommodation, please let us know by completing this form.
You apply on The Muse or on the employer's page; AtiveSite does not receive or process applications and is not affiliated with The Muse. The description above is shown as the source published it.
About the role
This is a Senior Level role in the Technology field (Cybersecurity) at Uber. Senior roles usually expect substantial experience, ownership of results and often the ability to guide others.
We could not match this job title to one occupation in the official wage statistics, so no pay estimate is shown. Pay is not in the source listing; ask the employer for the range and compare in the 240 job niches.
Does the pay work here? (estimate)
Estimate for a wage earner: 2026 federal brackets and standard deduction (IRS), Social Security 6.2% up to $184,500, Medicare 1.45% (+0.9% above $200,000 single / $250,000 married), and a state rate you set; set your own state tax rate. It ignores credits, pre-tax deductions, local taxes and benefits. Sources: IRS: tax year 2026 inflation adjustments · SSA wage base per Federal Register notice 2025-19763.
How to prepare and behave
This is editorial guidance, not information from the employer.
Read the whole description and match your examples to its requirements; use the same words the posting uses where they are true for you.
Research the employer before the interview: what it does, who its customers are and recent news; prepare two or three questions about the work.
Arrive early (or log in early for a video call), dress one step above the daily dress code, and test your camera and audio beforehand.
Answer with short stories: the situation, what you did and the result. Give numbers when you have them and never invent them.
Be honest about gaps; say what you did to learn and how fast you can close them.
Ask about the team, the first 90 days, how success is measured and the schedule; do not open with salary and time off.
When pay comes up, know the market range for the occupation and your lowest acceptable offer before you answer; ask for the full package in writing.
Send a short thank-you message within a day, mentioning one thing you discussed.
Have code, data work or projects you can show, and be ready to think aloud: many technical interviews test how you reason, not only the answer.
The job is in Seattle, WA. Below is what the official statistics say about living and working there.
How Seattle compares. Among the 80 largest places in Washington, Seattle is #1 by population, #76 for homeownership (#1 = highest), #8 for college degrees (#1 = most), #8 for remote work (#1 = most). Its county, King County, is #1 of 39 counties for average pay ($132,279).
The place in numbers
Seattle has 754,195 residents (ACS 2020–2024), about 9.6% of the population of Washington. It covers 84 square miles of land, which works out to roughly 8,979 people per square mile. The median age is 35.6, 7% younger than the state median (35.6 against 38.3).
Housing
The median gross rent is $2,030 a month (rent plus utilities), 15% above the state median ($2,030 against $1,760). Over a year that is 19.7% of the median household income. US housing guidance treats housing as affordable when it takes 30% of income or less, so the typical household is under that line. The median home value is $938,600, which is 7.6 times the median household income ($123,860); a ratio above 5 usually means buying is out of reach without savings or a second income. 43.7% of households own their home, 31% below the state average (43.7% against 63.8%). A low ownership share points to a rental-heavy market with more apartments and shorter stays.
Work and pay
The Seattle-Tacoma-Bellevue, WA metropolitan area has 2,086,210 jobs in the BLS wage survey, and the median pay across all occupations is $72,610 a year, 42% above the national median ($72,610 against $50,980). The biggest occupation groups are office and administrative support (212,900 jobs, median $59,660); business and financial operations (201,160 jobs, median $101,950); computer and mathematical (194,970 jobs, median $156,000). The area is most specialised in computer and mathematical (2.8 times) and architecture and engineering (1.4 times), where the share of workers is well above the national share. The best-paying groups with at least 5,000 jobs are management ($168,110) and computer and mathematical ($156,000). In 2026M09 the unemployment rate of King County was 4.8%. 74.0% of residents aged 16 and over are in the labour force. The city lies in King County; its jobs, pay by industry and GDP are on the county page.
Getting around
Among workers, 36.6% drive alone, 11.9% use public transit, 8.1% walk, 34.8% work from home. 13.9% of workers commute 45 minutes or more, 18% below the state average (13.9% against 16.9%). Remote work is more common than in the state as a whole, which widens the set of employers a resident can work for without moving.
People and education
68.5% of adults aged 25 and over hold a bachelor's degree or higher, 73% above the state share (68.5% against 39.6%). 20.1% of residents were born outside the United States, 31% above the state share (20.1% against 15.4%). The poverty rate is 9.9%, about the same as the state rate (9.9% against 9.9%).
Climate
The warmest month is Aug, averaging 65°F (18.3°C), and the coolest is Dec at 39°F (3.8°C). About 1,230 mm (48 inches) of precipitation falls in a year; Nov is the wettest month (188 mm) and Jul the driest (19 mm). These values come from NASA satellite-based climatology on a grid of about 50 km, so they describe the wider area, not a weather station in the city.
Nearby cities to compare
Closest cities in this guide: Mercer Island (7 miles, rent 23% higher); Bainbridge Island (7 miles, rent 8% higher); Kirkland (9 miles, rent 18% higher); Bellevue (9 miles, rent 27% higher). Rent differences are against Seattle; use the Compare tab to put any two cities side by side.
These links go to official sources and open in a new window. The first one is the government's or company's own site as listed in Wikidata (property "official website"); check it before relying on it.
Places within 50 miles (straight line) of Seattle, WA that have a guide, with what living there costs. No pay estimate is shown because the title did not match one occupation.
Company description (from The Muse): Uber is changing how people think about transportation, part of the logistical fabric of 600+ cities. Whether it’s a ride, a sandwich, or a package, Uber gives people what they want when they want it.
size: Large Size; industries: Technology; locations on The Muse: Amsterdam, Netherlands, Bangalore, India, Buenos Aires, Argentina, Chicago, IL, Dallas, TX, Hong Kong.
We do not hold headcount or revenue for this employer. Check its careers site and, if it is listed on a stock exchange, its public filings (SEC EDGAR search).
What it is like to work at a company (culture, schedules, benefits) is not in the source data, so we do not describe it. Read the description and ask the questions under "How to prepare".
What is the Sr Staff Security Engineer - Engineer job at Uber?
A senior level role in technology (cybersecurity) listed 10 days ago. The full description is on this page and on The Muse.
Where is this job?
Seattle, WA.
How do I apply?
Use the "View this job and apply on The Muse" button. AtiveSite does not receive applications.
How much does it pay?
The listing does not publish pay, and we could not match the title to one official occupation.
What is the cost of living there?
Median rent in Seattle is $2,030 a month and median household income $123,860 (ACS 2020–2024).
How old is this listing?
It was posted on 2026-10-29 (10 days ago). Jobs older than 90 days are not shown.
Are there similar jobs?
Yes: browse cybersecurity jobs in Washington.
Sources and terms
Job data: The Muse public API (listing dated 2026-10-29). The job disappears from this site when it disappears from the source.
Wages and projections: BLS OEWS (May 2025) and Employment Projections 2025–35.
City and county figures: Census Bureau ACS 2020–2024, BEA, BLS QCEW and LAUS, NASA POWER climatology; distances from Census Gazetteer coordinates.
AtiveSite is not affiliated with or endorsed by The Muse, the employer or any government agency, and does not process applications. Verify every detail with the employer before acting.