Drive decisions and coordinated execution. Establish incident objectives, roles, priorities, escalation paths, and operating cadence. Coordinate investigation, containment, remediation, and recovery across Security, Infrastructure, Product, and Business teams, resolving dependencies and driving actions to completion.
Lead sensitive incident coordination and communication. Partner with Legal, Privacy, People, Communications, and other stakeholders to navigate complex incidents. Give executives clear assessments of impact, uncertainty, response options, and decisions required.
Own the Cyber Resilience program. Establish continuous testing and validation of detection and response capabilities across people, processes, and technology. Test the full path from adversary activity through telemetry, detection, triage, escalation, containment, and recovery.
Lead Purple Team. Set priorities for collaborative adversary emulation and testing with offensive security, threat intelligence, detection engineering, and response teams. Use realistic attack scenarios to expose gaps, drive improvements, and retest to verify that fixes work.
Own the Insider Threat Program. Define the program’s strategy, operating model, and roadmap with Security, Legal, Privacy, and People partners. Strengthen prevention, detection, investigation, and response to insider risks, with disciplined handling of sensitive information and respect for employee privacy.
Build organizational readiness. Own tabletop exercises, incident simulations, premortems, and post-incident reviews. Translate internal lessons, external incidents, and emerging threats into prioritized improvements with clear owners and verified outcomes.
Guide engineering, automation, and AI investments. Lead the development and integration of tools that improve incident coordination, evidence synthesis, decision support, and readiness testing. Define clear approval boundaries, auditability, and human oversight for consequential actions.
Set direction and measure results. Own the team’s roadmap, staffing, and delivery commitments. Establish measures for command readiness, detection and response effectiveness, validated threat coverage, and closure of recurring gaps. Integrate security response and production incident management practices to improve execution across Uber.
Build and grow the team. Hire, coach, and develop incident commanders and engineers. Set clear expectations for performance and technical quality, support career growth, and build an inclusive culture grounded in accountability, sound judgment, and continuous learning.
Basic Qualifications
8+ years of experience in security incident response, security engineering, production incident management, or security and infrastructure operations.
Experience directly managing technical teams, including hiring, performance management, career development, and delivery accountability.
Experience serving as incident commander or incident lead for high-severity cybersecurity or production incidents in complex, distributed environments.
Demonstrated ability to establish command, prioritize actions, and drive decisions across teams with competing demands and incomplete information.
Working knowledge of cybersecurity investigation, containment, and recovery across infrastructure, applications, identity, and cloud services.
Experience owning a technical program or operational capability, including setting priorities, delivering improvements, and measuring effectiveness.
Strong written and verbal communication skills, including communicating technical risk, business impact, and response decisions to senior leaders.
Preferred Qualifications
Experience managing a cybersecurity incident command or response team operating globally with on-call and follow-the-sun coverage.
Experience building or leading Purple Team, adversary emulation, or continuous security validation programs, using frameworks such as MITRE ATT&CK to prioritize and assess coverage.
Experience leading an Insider Threat Program or coordinating sensitive insider investigations with Legal, Privacy, and People teams.
Experience designing exercises that test detection, escalation, containment, and recovery, and translating findings into verified improvements.
Experience leading engineering teams that build incident management platforms, response automation, or AI-assisted operational workflows.
Experience integrating cybersecurity response with SRE or production incident management practices.
A track record of improving response effectiveness through post-incident learning, measurable readiness standards, and sustained remediation of systemic gaps.
For Seattle, WA-based roles: The base salary range for this role is USD $232,000 per year - USD $258,000 per year.
You will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.
