Sr Security Technologist - Human Risk Management

About the Role
Uber’s Human Risk Management (HRM) team helps people recognize and reduce security risk through training, communications, and behavior change.
As a Senior Security Technologist within Engineering Security, you will build and run Uber’s security learning and awareness program. Using an established annual communications calendar and prioritized threat themes, you will develop a risk-based curriculum, prepare campaigns ahead of schedule, and tailor content to the audiences who need it.
This role combines security expertise with hands-on instructional design and adult learning experience. You will define measurable learning objectives, create effective training, and use data to assess whether it changes behavior. You will also identify when a control, process, or tooling change would address risk more effectively than awareness.
What You’ll Do
Own the security awareness curriculum, mapping risk topics to audiences, delivery formats, schedules, and module dependencies.
Develop complete training modules, including scripts, storyboards, interactive content, and assessments tied to measurable learning objectives. Maintain an assessment bank with documented answers and rationale.
Create targeted content for elevated-risk audiences, including engineering, finance, executive support, and new joiners.
Produce accessible, localization-ready content that meets Uber’s standards. Package modules for Uber’s learning platform, using formats such as SCORM or xAPI, and validate completion and score reporting.
Deliver campaigns ahead of the annual communications calendar, adapting content for email, Slack, intranet, digital signage, manager talking points, and short-form video.
Tailor messaging for technical and non-technical audiences while maintaining a consistent narrative. Own reusable message libraries, style and tone guides, and campaign templates.
Conduct structured stakeholder interviews to understand role-based risks, control friction, misconceptions, and effective communication channels. Maintain audience and threat-to-message maps to connect content to risks and identify coverage gaps.
Identify risks that require changes to controls, processes, or tooling, and route findings to the responsible teams.
Measure engagement, completion, assessment performance, and behavioral outcomes. Connect results to signals from phishing simulations, identity, endpoint, and security reporting systems to improve the program and inform executive reporting.
Partn