Software Engineer II - Security Review Automation

Uber’s Offensive Security team is seeking a Software Engineer II to build security review automation and AI-powered tools for continuous, scalable security testing.

Responsibilities

• Build security platforms and automation across SAST, DAST, SCA, penetration testing, AI red teaming, security design reviews, and threat modeling
• Develop AI-powered agents and workflows that analyze source code and technical designs, orchestrate security assessments, generate test cases, and validate findings
• Partner with security engineers to turn expertise into repeatable, scalable capabilities
• Build and scale foundational infrastructure and data pipelines, balancing technical debt with shifting priorities while preserving long-term impact
• Integrate security capabilities with source control, CI/CD pipelines, service inventories, and issue-tracking systems to support continuous and on-demand testing
• Create shared services for assessment orchestration, findings normalization and deduplication, and remediation tracking to reduce duplicate findings and manual effort for security and engineering teams
• Design, develop, and maintain high-quality code for features of moderate complexity and projects with multiple dependencies
• Develop evaluation frameworks and operational safeguards for AI-driven security workflows, including accuracy, coverage, latency, and cost, plus access controls, execution boundaries, and auditability
• Own the software lifecycle end-to-end, from drafting design docs to debugging production issues and managing incidents independently
• Collaborate across Product, Data Science, and Ops to convert ambiguous requirements into simple, reliable system designs
• Support engineering best practices through quality code reviews, comprehensive tests, and performance improvements
• Navigate internal complexity and stakeholder inquiries to remove blockers and ensure production environment reliability

Requirements

• 3+ years of professional software engineering experience in backend development, distributed systems, or data engineering
• Proficiency in one or more object-oriented or functional programming languages (examples: Go, Java, Python, C++)
• Experience with data modeling, query optimization, and translating customer problems into system design
• Bachelor’s Degree (or equivalent experience) in Computer Science, Engineering, or a related technical field
• Experience writing tests to verify functionality and establishing monitoring systems to ensure code stability
• Experience building APIs, service integrations, or automated workflows that connect multiple systems in production
• Understanding of secure software development fundamentals: authentication, authorization, data protection, and safe handling of credentials
• Familiarity with source control, CI/CD, and automated testing practices for reliable software delivery

Technologies

• Go, Java, Python, C++
• SAST, DAST, SCA
• CI/CD, Spark, Flink, Kafka
• LLMs

Preferred Qualifications

• Experience building agentic security workflows that gather technical context, reason across multiple data sources, invoke security tools, validate conclusions, and produce evidence-backed assessments
• Experience applying frontier LLMs to complex security reasoning, including architecture analysis, attack-path identification, threat enumeration, vulnerability discovery, and security control validation
• Experience developing multi-agent or multi-model architectures (specialized agents, model routing, model-as-judge) to improve accuracy, coverage, and confidence
• Experience identifying and reducing code-level technical debt in high-load distributed systems
• Background in mentoring new team members and contributing to engineering culture
• Proficiency with Big Data frameworks (e.g., Spark, Flink) or real-time streaming (e.g., Kafka)
• Demonstrated ability to exercise sound judgment on engineering trade-offs for complex systems
• Experience building security tools or automation in one or more domains: SAST, DAST, SCA, penetration testing, AI red teaming, security design reviews, or threat modeling
• Experience developing LLM-powered applications or agentic workflows, including model integration, tool execution, context retrieval, and orchestration
• Experience building evaluation frameworks for AI-driven systems, including reproducible benchmarks, regression testing, and output quality and reliability measurement
• Familiarity with source-code analysis, dependency graphs, API testing, or isolated execution environments for automated security testing
• Experience using AI-assisted development tools to accelerate implementation, testing, debugging, and maintenance

Location

• Seattle, WA (onsite)

Compensation

• Base salary range: USD 171,000 - 190,000 per year

Benefits

• Eligible to participate in Uber’s bonus program (for all US locations)
• May be offered an equity award and other types of compensation
• 401(k) plan eligibility for all full-time employees
• Various benefits (details not provided)

About the Role and Team

• Member of Uber’s Offensive Security team building security tools, platforms, and AI-powered automation to enable security testing and risk reduction at Uber scale
• Focus on building for messy, global systems with imperfect information, end-to-end ownership, and reliability under high-load conditions

Workplace Requirements

• Unless approved for full remote work, employees must spend at least 50% of their time in-office
• Some roles (e.g., at greenlight hubs) may require full-time in-office presence

Education: Bachelor’s Degree (or equivalent experience) in Computer Science, Engineering, or a related technical field

Minimum Experience: 3 years