Security Investigator Ii

**About the Role**

Uber's Security Response and Investigations (SRI) team is the cybersecurity incident response body at Uber. SRI responds to security incidents and mitigates security threats across the company. The SRI team is made of three teams: vSOC (virtual Security Operations Center), Investigations and Automation, and Incident Command. You will be joining the Investigations and Automation team. As a Security Engineer on the Investigations and Automation team, you will be on the ground floor, responding to security incidents, providing hands-on investigations, forensics, and response expertise, developing automation solutions, and helping to shape security responses at Uber. You will also partner closely with the security operations center analysts and incident commanders, leading incident investigations and providing mentorship to analysts.
- What Yoy Will Do
Conduct rapid response, mitigation, and investigations on highest priority incidents impacting Uber and user data.
- Conduct forensics investigations and present findings.
- Partner with global team members to drive response and investigations globally.
- Partner closely with the SOC analysts and incident commanders, leading incident investigations.
- Produce concise yet thorough case reports for internal and external stakeholders.
- Lead automation projects and develop automation to improve the consistency and efficiency of incident response.
- Lead projects/initiatives to help mature the incident response program and reduce cybersecurity risk at Uber and Uber’s subsidiaries. These projects/initiatives include but are not limited to threat hunting, compromise assessments, and real-time incident simulations.
- Support and mentor analysts conducting investigations and triage.
- Manage multiple incidents and projects at once while effectively prioritizing time.
- What You Will Need
Must be highly experienced in the incident response lifecycle.
- 4+ years of hands-on experience on a security engineering or operations team responding to cyber security incidents.
- Strong foundation in security principles.
- Familiarity with common threat actor attack patterns and TTPs.
- Strong problem-solving skills.
- Threat hunting experience.
- Experience with cybersecurity forensic methodologies and software.
- Experience driving complex incidents or leading large investigations end-to-end.
- Technical experience with DevOps and scripting languages for automating data gathering and investigation workflows. Experience with building automations for incident response is a plus.
- Experience leading large-scale threat hunts.
- Applied knowledge of cyber intel frameworks such as ATT&CK framework and kill-chain model.
- Experience working crisis events for a global company. Ability to work across geographically distributed teams.

At Uber, we reimagine the way the world moves for the better. The idea was born on a snowy night in Paris in 2008, and ever since then, our DNA of reimagination and reinvention carries on. We’ve grown into a global platform moving people and things in ever-expanding ways, taking on big problems to help drivers, riders, delivery partners, and eaters make movement happen at the push of a button for everyone, everywhere.

We welcome people from all backgrounds who seek the opportunity to help build a future where everyone and everything can move independently. If you have the curiosity, passion, and collaborative spirit, work with us, and let’s move the world forward, together.

Uber is proud to be an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you have a disability or special need that requires accommodation, please let us know by completing this form.

Offices continue to be central to collaboration and Uber’s cultural identity. Unless formally approved to work fully remotely, Uber expects employees to spend at least half of their work time in their assigned office. For certain roles, such as those based at green-light hubs, employees are expected to be in-office for 100% of their time. Please speak with your recruiter to better understand in-office expectations for this role.