Sr. Security Investigator

About the Role

The CyberSecurity Incident Response team (CIRT) is at the forefront of protecting Uber. We are a hands-on, fast-paced team that responds to security incidents, conducts forensic investigations, and builds automated solutions to scale our defenses.

As a  Senior Security Investigator, your role is to lead complex, high-impact security investigations across a global, large-scale environment. This role is ideal for a seasoned security professional who excels at uncovering sophisticated threats, driving automation at scale, shaping investigative strategy, and mentoring teams to deliver world-class response.

You will partner with Security Engineering, Detection & Response, Threat Intelligence, Legal, HR, and Executive Leadership to contain threats, protect user and corporate data, and elevate our overall security posture.

What the Candidate Will Need / Bonus Points

---- What the Candidate Will Do ----

1. Lead complex security investigations end-to-end and perform deep forensic analysis across endpoints, cloud environments, identity systems, networks, and application logs to uncover root cause and attack paths.
2. Own & Build automation and tooling to accelerate evidence collection, log enrichment, triage workflows, and decision-making at global scale.
3. Improve detection and response capabilities by partnering with Threat Intelligence, Detection Engineering, and Platform teams.
4. Lead major cross-functional security initiatives that strengthen investigative readiness, digital forensics, cloud incident response, and threat-hunting capabilities.
5. Mentor and develop investigators and analysts, providing technical guidance, reviewing casework, and elevating investigative rigor.
6. Continuously evolve investigation methodology by analyzing trends, identifying gaps, and embedding lessons learned back into the security ecosystem.

---- Basic Qualifications ----

1. Bachelor's degree in Computer Science, Information Security, or a related field..
2. 5+ years of experience in Security Investigations, Incident Response, Threat Hunting, or Digital Forensics within large-scale or high-risk environments.
3. Proven expertise with forensic tooling, log analysis, SIEM platforms, EDR solutions, and cloud investigation workflows (AWS/GCP/Azure).
4. Strong understanding of attacker TTPs, modern threat landscape, and frameworks like MITRE ATT&CK.
5. Hands-on experience building automation using Python, APIs, SOAR, or equivalent frameworks.
6. Ability to lead complex investigations end-to-end and communicate findings effectively to senior leadership.
7. Experience running or contributing to large cross-company security projects.

---- Preferred Qualifications ----

1. Experience in a large-scale, global, distributed systems environments
2. Knowledge of identity ecosystems (Okta, Azure AD), container security, and SaaS platform logs.
3. Experience in a programming language (e.g., Python, Go, C++, Java, etc) for incident response related automation and data analysis. 
4. Experience with GenAI in incident response and investigations is a plus.
5. Experience mentoring or leading security teams.

~~ ~~

For San Francisco, CA-based roles: The base salary range for this role is USD$180,000 per year - USD$200,000 per year.

For Seattle, WA-based roles: The base salary range for this role is USD$180,000 per year - USD$200,000 per year.

For Sunnyvale, CA-based roles: The base salary range for this role is USD$180,000 per year - USD$200,000 per year.

For all US locations, you will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits. More details can be found at the following link https://jobs.uber.com/en/benefits.

Ready to Ride?

This isn't the kind of place where you follow a playbook — it's where you help write one. If you're driven by impact, energized by challenge, and ready to shape how the world moves — we'd love to hear from you.

You may be eligible for bonuses, equity, and other compensation, as well as a range of benefits. Explore our benefits.

Offices remain key to collaboration and Uber's culture. Unless approved for full remote work, employees must spend at least 50% of their time in-office. Some roles, like those at greenlight hubs, require full-time in-office presence. Ask your Recruiter for details about this role's requirements.

Uber is proud to be an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires accommodation, please let us know by completing this form.