Security Engineer

Job Title: Security Engineer

Location: Sunnyvale, CA/Seattle, WA (Hybrid)

Duration: 06+ months

Description

Contract Security Engineer — Security & Privacy Reviews

About the role

As a contract Security Engineer on Uber’s Security Review Team, you will proactively identify and reduce security and privacy risks across critical services, third-party platforms, and emerging AI technologies. Your primary focus will be reviewing engineering proposals and ERDs, building automation to scale security assessments, and conducting hands-on adversarial testing of AI agents.

You will partner with engineering, security, and privacy teams to turn findings into practical design improvements and reusable security controls.

What you’ll do

• Conduct ERD security and privacy reviews: Evaluate engineering proposals, architecture, and data flows across applications, APIs, cloud infrastructure, and AI systems. Identify risks involving authentication, authorization, sensitive data handling, data minimization, retention, and third-party sharing.
• Perform threat modeling: Identify potential abuse cases and attack paths, recommend mitigations, and work with engineering teams to address risks before deployment.
• Assess and test AI agents: Evaluate third-party and internally developed coding and work-focused agents through adversarial testing. Examine prompt injection, tool use, permissions, data access, sensitive data exposure, and external integrations.
• Build security automation: Develop tools and AI-assisted workflows to streamline ERD reviews, threat modeling, evidence collection, and security testing, increasing assessment coverage and consistency.
• Conduct targeted penetration testing: Validate security assumptions and identify exploitable vulnerabilities in critical services, applications, APIs, and AI agents.
• Drive remediation and share knowledge: Communicate actionable findings, validate fixes, and develop guidance that helps teams prevent recurring security and privacy issues.

Required qualifications

• 5+ years of relevant professional experience, including 3+ years in security engineering or a related security role.
• Experience conducting security design reviews, threat modeling, and privacy risk assessments.
• Hands-on penetration testing experience and a strong understanding of application, API, cloud, and data security.
• Software development or scripting experience, with the ability to build tools and automate security workflows.
• Familiarity with AI agent architectures and risks involving prompt injection, tool execution, permissions, and data access.
• Strong written and verbal communication skills, including the ability to explain risks and recommend practical mitigations.
• Ability to work independently with minimal supervision and collaborate across engineering, security, and privacy teams.
• Bachelor’s or master’s degree in computer science, cybersecurity, or a related field, or equivalent practical experience.

Preferred qualifications

• Experience assessing AI agents, LLM applications, or third-party AI platforms.
• Experience building AI-powered security review or testing automation.
• Experience evaluating vendor security readiness and handling sensitive or business-critical data.
• Relevant security certifications, such as OSCP or CISSP.
• A passion for learning, teaching, and improving security practices.

Flexible work from home options available.