Sr Security Technologist - Governance, Risk, and Compliance
Iaziqy Ubercareers · Seattle, Washington, United States
About the Role
Uber's Tech Risk and Assurance team, part of Engineering Security, helps Uber understand its cybersecurity risk, decide what to do about it, and prove that controls work. Our goal is to make every experience with Uber simple, secure, and safe for riders, eaters, drivers, and partners.
As a Senior Security Technologist, GRC, you will run key parts of Uber's cyber risk management program: risk intake and assessment, risk treatment and acceptance decisions, and the reporting leaders use to see where risk sits and what has been decided. You will partner with engineering, security, audit, privacy, and compliance teams to turn control gaps, threat context, and regulatory requirements into treatment plans that engineering teams can execute, and follow those plans through to closure.
This role combines risk judgment with hands-on technical skill. You will be comfortable reading architecture and design documents, querying data, and building automation on GRC platforms and workflow tools so that risk processes scale without adding manual work. You will work within program goals set with senior leadership and own the design and delivery of the components assigned to you.
What You'll Do- Own cyber risk intake, triage, and prioritization for your program area, so that each risk has a clear owner, a well-formed risk statement, and a timely treatment decision.
- Lead risk assessments, including annual and targeted assessments of systems, applications, and new business areas, and present results with clear recommendations.
- Run the risk exception and acceptance workflow. Confirm that requests have the right context, route them to the right approver, track conditions and expiry dates, and escalate decisions that exceed delegated authority or risk tolerance.
- Partner with engineering teams to define risk treatment plans, identify sustainable fixes, and drive mitigation to the last mile rather than stopping at documentation.
- Contribute to control design reviews and risk decisions that require judgment, stakeholder alignment, and trade-off management.
- Own the roadmap and delivery of one or more components of Uber's risk and compliance tooling. Gather requirements from partner teams, write technical specifications, and work with engineers to ship releases in an Agile delivery model.
- Configure and improve workflows on GRC platforms such as ServiceNow eGRC and Jira, including forms, business rules, client scripts, UI actions, and automation rules.
- Build automation that removes manual steps from risk workflows using Python, SQL, platform APIs, workflow tools, and approved AI tools. Examples include routing approvals, expiring acceptances, and drafting first-pass risk summaries for human review.
- Load, transform, and reconcile data between GRC platforms and other systems, and perform system and integration testing with sample and live data.
- Build and maintain risk reporting for leaders and partner teams, including KRIs, exposure trends, acceptance aging, decision status, and escalation triggers. Design dashboards and reports that support program requirements.
- Prepare material for risk governance forums, including decision papers that set out the risk, the options, and a recommendation.
- Improve risk workflows through better tooling, clearer operating models, and reusable knowledge assets such as runbooks and templates.
- Mentor and onboard analysts and junior team members on risk analysis, risk statement quality, treatment planning, and stakeholder communication.
Basic Qualifications- Bachelor's degree in Computer Science, Computer Engineering, Information Systems, Cybersecurity, Risk Management, or a related field, or equivalent practical experience.
- 5+ years of experience in security, cyber risk, GRC, assurance, security operations, or related technical risk roles.
- Experience running parts of a security risk program end to end, including risk assessments, treatment decisions, and cross-functional follow-through.
- Strong understanding of security controls and risk treatment, with the technical fluency to work with engineers on implementation details in areas such as identity and access, cloud infrastructure, logging, vulnerability management, and secure configuration.
- Hands-on automation experience, including scripting in Python or a similar language, querying data with SQL, and using APIs or workflow tools to automate a process.
- Knowledge of control frameworks and standards such as NIST CSF, NIST 800-53, ISO 27001, SOC 2, and CIS.
- Experience working across multiple stakeholders, handling ambiguity, and driving accountability with limited supervision.
- Excellent written and verbal communication skills, including presenting risk, status, and decision points to director-level and technical audiences.
Preferred Qualifications- Security or audit certifications such as CISA, CISSP, CISM, CRISC, or ISO 27001 Lead Auditor.
- Hands-on experience with the ServiceNow eGRC platform, including configuration, workflow development, and integration.
- Experience with other GRC or ERM tools such as AuditBoard, Archer, OpenPages,Vanta or SAP GRC.
- Experience applying AI or LLM tools to risk work, such as summarizing evidence, classifying findings, or drafting assessments, with appropriate human review.
- Experience with risk quantification methodologies and risk lifecycle tooling.
- Experience building dashboards in tools such as Tableau, Looker, or ServiceNow Performance Analytics.
- Big 4 accounting firm and/or internet or technology industry experience.
- Process management experience, including process redesign and optimization.
- Track record of driving security risk treatment to closure across multiple engineering teams.
- Ability to thrive in environments of uncertainty.
About the role and team
Engineering at Uber means building for real-world impact under real-world constraints. The problems are complex, the systems are massive, and the pace is fast. You’ll need to make smart decisions with imperfect information — and own them. If you think in systems, stay calm under pressure, and care about building things that actually work — this is where you’ll grow.
As a Sr. Security Technologist, you will lead high-stakes initiatives in our > . This role sits at the nexus of technical investigation and scalable defense, blending the roles of a "Fire Captain" orchestrating critical-severity incident responses and a "Software Architect" building automated control assurance for our global cloud footprint. We are looking for a leader who can stay composed while communicating incident strategies to executives and then pivot to developing backend automation to reduce manual risk. You’ll set the technical standard for incident handling and continually elevate the craft of security across the organization.
What you’ll do
- Lead security incident response teams through high-criticality cybersecurity events, serving as the primary incident commander and orchestrating containment with confidence under intense pressure.
- Design, develop, and implement automated assurance controls and risk detection systems (using Python, Go, or Java) to replace manual testing across BPO, network, and cloud environments.
- Perform detailed root cause analysis and forensic investigations into sophisticated attacks, ensuring a rigorous technical understanding to prevent recurrence.
- Partner cross-functionally with Engineering and DevOps to integrate automated control validation into CI/CD pipelines and the software development lifecycle.
- Lead projects to mature the incident response program, including highly technical tabletop exercises, purple teaming, and large-scale threat hunting initiatives.
- Mentor junior analysts and specialists, coaching them in advanced investigative methodologies and elevating the technical craft of automation across the global organization.
Basic Qualifications
- Bachelor's degree in Computer Science, Engineering, Information