Job Description

About the Role

Uber’s Incident Command and Cyber Resilience team, part of the Threat Defense and Response (TDR) organization, leads the response to our highest-severity cybersecurity incidents and continuously tests our ability to detect, respond to, and recover from threats. We protect Uber’s people, products, infrastructure, and data across the intersection of the digital and physical world.

We are looking for an experienced engineering manager to lead a global team and own the strategy, roadmap, and execution across Incident Command, Purple Team, the Insider Threat Program, and Cyber Resilience. You will establish clear command during critical incidents, bring the right teams together, and drive decisions that reduce harm and restore secure operations.

Your responsibility extends beyond the incident itself. You will turn lessons from real events, adversary emulation, and continuous testing into stronger detections, more effective response, and demonstrated readiness. You will also guide engineering investments in automation and AI that improve response speed and quality while preserving human judgment and accountability.

This role requires a leader who can make sound decisions with incomplete information, communicate clearly under pressure, and develop people who do the same.

What the Candidate Will Do

• Lead Incident Command. Manage and develop a global team of incident commanders responsible for Uber’s highest-severity cybersecurity incidents, including active threats, critical vulnerabilities, insider risks, and security incidents involving large-scale fraud. Serve as a senior escalation point and assume command when needed.
• Drive decisions and coordinated execution. Establish incident objectives, roles, priorities, escalation paths, and operating cadence. Coordinate investigation, containment, remediation, and recovery across Security, Infrastructure, Product, and Business teams, resolving dependencies and driving actions to completion.
• Lead sensitive incident coordination and communication. Partner with Legal, Privacy, People, Communications, and other stakeholders to navigate complex incidents. Give executives clear assessments of impact, uncertainty, response options, and decisions required.
• Own the Cyber Resilience program. Establish continuous testing and validation of detection and response capabilities across people, processes, and technology. Test the full path from adversary activity through telemetry, detection, triage, escalation, containment, and recovery.
• Lead Purple Team. Set priorities for collaborative adversary emulation and testing with offensive security, threat intelligence, detection engineering, and response teams. Use realistic attack scenarios to expose gaps, drive improvements, and retest to verify that fixes work.
• Own the Insider Threat Program. Define the program’s strategy, operating model, and roadmap with Security, Legal, Privacy, and People partners. Strengthen prevention, detection, investigation, and response to insider risks, with disciplined handling of sensitive information and respect for employee privacy.
• Build organizational readiness. Own tabletop exercises, incident simulations, premortems, and post-incident reviews. Translate internal lessons, external incidents, and emerging threats into prioritized improvements with clear owners and verified outcomes.
• Guide engineering, automation, and AI investments. Lead the development and integration of tools that improve incident coordination, evidence synthesis, decision support, and readiness testing. Define clear approval boundaries, auditability, and human oversight for consequential actions.
• Set direction and measure results. Own the team’s roadmap, staffing, and delivery commitments. Establish measures for command readiness, detection and response effectiveness, validated threat coverage, and closure of recurring gaps. Integrate security response and production incident management practices to improve execution across Uber.
• Build and grow the team. Hire, coach, and develop incident commanders and engineers. Set clear expectations for performance and technical quality, support career growth, and build an inclusive culture grounded in accountability, sound judgment, and continuous learning.

Basic Qualifications

• 8+ years of experience in security incident response, security engineering, production incident management, or security and infrastructure operations.
• Experience directly managing technical teams, including hiring, performance management, career development, and delivery accountability.
• Experience serving as incident commander or incident lead for high-severity cybersecurity or production incidents in complex, distributed environments.
• Demonstrated ability to establish command, prioritize actions, and drive decisions across teams with competing demands and incomplete information.
• Working knowledge of cybersecurity investigation, containment, and recovery across infrastructure, applications, identity, and cloud services.
• Experience owning a technical program or operational capability, including setting priorities, delivering improvements, and measuring effectiveness.
• Strong written and verbal communication skills, including communicating technical risk, business impact, and response decisions to senior leaders.

Preferred Qualifications

• Experience managing a cybersecurity incident command or response team operating globally with on-call and follow-the-sun coverage.
• Experience building or leading Purple Team, adversary emulation, or continuous security validation programs, using frameworks such as MITRE ATT&CK to prioritize and assess coverage.
• Experience leading an Insider Threat Program or coordinating sensitive insider investigations with Legal, Privacy, and People teams.
• Experience designing exercises that test detection, escalation, containment, and recovery, and translating findings into verified improvements.
• Experience leading engineering teams that build incident management platforms, response automation, or AI-assisted operational workflows.
• Experience integrating cybersecurity response with SRE or production incident management practices.
• A track record of improving response effectiveness through post-incident learning, measurable readiness standards, and sustained remediation of systemic gaps.

For Seattle, WA-based roles: The base salary range for this role is USD $232,000 per year - USD $258,000 per year.

You will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.

Ready to Ride?

This isn't the kind of place where you follow a playbook — it's where you help write one. If you're driven by impact, energized by challenge, and ready to shape how the world moves — we'd love to hear from you.

You may be eligible for bonuses, equity, and other compensation, as well as a range of benefits. Explore our benefits.

Offices remain key to collaboration and Uber's culture. Unless approved for full remote work, employees must spend at least 50% of their time in-office. Some roles, like those at greenlight hubs, require full-time in-office presence. Ask your Recruiter for details about this role's requirements.

Uber is proud to be an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires accommodation, please let us know by completing this form.