Security Technologist II - Technical Risk & Assurance

About the Role
Uber's Tech Risk and Assurance team, part of Engineering Security, helps Uber understand its cybersecurity risk, decide what to do about it, and prove that controls work. Our goal is to make every experience with Uber simple, secure, and safe for riders, eaters, drivers, and partners.
As a Security Technologist II, you will work on both risk and assurance projects. On the assurance side, you will test whether security controls are designed and operating effectively across Uber's systems, infrastructure, and vendors, and help automate that testing so it runs continuously. On the risk side, you will support risk assessments, maintain risk and issue records, and analyze exceptions so that leaders can see where risk sits and what has been decided.
This role suits someone who is technically fluent and likes to automate. You will read system configurations and access data, write scripts and queries to collect evidence and test controls at scale, and use AI tools to reduce manual review. Senior team members set the scope of your projects, and you will own their delivery end to end.
What You'll Do
Test the design and operating effectiveness of security controls across enterprise IT, cloud, SaaS, and third-party environments, and document clear, evidence-based findings.
Conduct control and configuration assessments to identify deviations from policy, standards, and baseline requirements, and give guidance on remediation and audit readiness.
Build and maintain automated control tests and continuous control monitoring in partnership with system owners, so that controls are tested on full populations rather than samples.
Write scripts and queries to collect and validate audit evidence, reducing manual effort for the assurance team and engineering stakeholders.
Support internal and external audits and certifications, such as SOC 2, ISO 27001, PCI DSS, and regional regulatory assessments, including evidence requests and walkthroughs.
Track corrective actions from audits and assessments, including Plans of Action and Milestones (POA&Ms), and follow up with owners until issues are closed.
Support risk assessments of systems, applications, and vendors. Gather context, identify risks to the confidentiality, integrity, and availability of information systems, and draft risk statements and treatment recommendations.
Maintain risk register and issue records so that each risk has a current rating, owner, and status, and link control test results and audit findings to the risks they affect.
Review security exception requests for completeness, compensating controls, and expiry, and flag repeat or long-running exceptions for escalation.