Sr Security Technologist - Governance, Risk, and Compliance

About the Role
Uber's Tech Risk and Assurance team, part of Engineering Security, helps Uber understand its cybersecurity risk, decide what to do about it, and prove that controls work. Our goal is to make every experience with Uber simple, secure, and safe for riders, eaters, drivers, and partners.
As a Senior Security Technologist, GRC, you will run key parts of Uber's cyber risk management program: risk intake and assessment, risk treatment and acceptance decisions, and the reporting leaders use to see where risk sits and what has been decided. You will partner with engineering, security, audit, privacy, and compliance teams to turn control gaps, threat context, and regulatory requirements into treatment plans that engineering teams can execute, and follow those plans through to closure.
This role combines risk judgment with hands-on technical skill. You will be comfortable reading architecture and design documents, querying data, and building automation on GRC platforms and workflow tools so that risk processes scale without adding manual work. You will work within program goals set with senior leadership and own the design and delivery of the components assigned to you.
What You'll Do
Own cyber risk intake, triage, and prioritization for your program area, so that each risk has a clear owner, a well-formed risk statement, and a timely treatment decision.
Lead risk assessments, including annual and targeted assessments of systems, applications, and new business areas, and present results with clear recommendations.
Run the risk exception and acceptance workflow. Confirm that requests have the right context, route them to the right approver, track conditions and expiry dates, and escalate decisions that exceed delegated authority or risk tolerance.
Partner with engineering teams to define risk treatment plans, identify sustainable fixes, and drive mitigation to the last mile rather than stopping at documentation.
Contribute to control design reviews and risk decisions that require judgment, stakeholder alignment, and trade-off management.
Own the roadmap and delivery of one or more components of Uber's risk and compliance tooling. Gather requirements from partner teams, write technical specifications, and work with engineers to ship releases in an Agile delivery model.
Configure and improve workflows on GRC platforms such as ServiceNow eGRC and Jira, including forms, business rules, client scripts, UI actions, and automation rules.
Build automation that removes manual steps from risk workflows using Python, SQL, platform APIs, workflow tools, and approved AI tools. Examples include routing approvals, expiring acceptances, and drafting first-pass risk summaries for human review.
Load, transform, and reconcile data between GRC platforms and other systems, and perform system and integration testing with sample and live data.