Staff Security Technologist - Incident Commander

About the Role As a Staff Security Technologist, Incident Command, you are accountable for leading Uber's most critical, complex, and high-impact security incidents end-to-end - from escalation to containment, recovery, and systemic remediation - and owning the operational and technical effectiveness of the incident-command function. This role will sit in either our Seattle, San Francisco, or Sunnyvale office. You operate at the intersection of Fire Captain, NTSB Investigator, and hands-on technical practitioner. In the moment, you take command - setting strategy, assigning resources, and making high-consequence decisions under pressure. After the smoke clears, you drive deep technical investigation and post-incident analysis to ensure we understand not just what happened, but why it happened, and that meaningful, durable fixes are made. This is not a passive coordination role. You are expected to be technically credible, decisive in ambiguity, and comfortable owning outcomes when there is no playbook. As a technical domain and cultural leader, you drive the priorities, goals, and delivery of a significant incident response program spanning multiple high-complexity projects. You align Security Technologists and partner teams across Engineering Security and adjacent functions - raising the technical bar, establishing reusable frameworks and best practices, and modernizing tooling and workflows to reduce risk across Uber. What the Candidate Will Do • Command the highest severity and most complex security incidents across Uber and its subsidiaries, serving as the single accountable leader during active response. • Participate in an on-call rotation where you are expected to make real-time decisions with incomplete information, balancing speed, risk, and impact, and model decisive, responsible action that keeps responders and stakeholders moving. • Act as the incident authority, not just a facilitator - forming hypotheses, setting strategy, and directing investigative focus while providing technical oversight to engineers and Security Technologists working across parallel response and remediation efforts. • Transition seamlessly between executive-level incident leadership and hands-on technical investigation, including log analysis, system interrogation, and root cause validation across complex systems and security domains. • Serve as the primary interface to senior leadership during critical incidents, translating evolving technical realities into concise, audience-aware updates with clear knowns, unknowns, risks, tradeoffs, and decisions needed. Align stakeholders and seek guidance from senior leaders as appropriate. • Build and maintain strong working relationships with global engineering, infrastructure, legal, privacy, and operations teams to enable fast, coordinated response, aligning competing goals and translating business needs, risks, and threats into actionable response requirements. • Conduct rigorous post-incident analysis in the spirit of an NTSB investigation - focused on systemic causes, contributing factors, and concrete prevention. Drive cross-team remediation with accountable owners, timelines, and validation of durable risk reduction. • Serve as a cultural and technical leader, actively mentoring responders, incident leaders, and promising engineers and architects. Share domain expertise and coach effective communication, sound decisions under uncertainty, and greater cross-organizational impact. • Own the priorities, goals, and delivery of a significant incident response program with multiple high-complexity projects, in partnership with Senior Manager and Director+ stakeholders. Align Security Technologists across related and adjacent efforts, provide technical and architectural direction, and proact