Sr Manager, Security Engineering - Engineer

The security organization at Uber is dedicated to enabling safe and secure innovation while protecting the communities we serve both online and in the physical world. Our team is responsible for protecting both people and their data across intersections of the digital and physical world. The primary objective for Uber's Engineering Security team is to enable the technical ambitions of the company while maintaining the highest standards of security and privacy for our customers and partners.

As cybersecurity threats evolve, so do we.

The security organization at Uber is dedicated to enabling safe and secure innovation while protecting the communities we serve both online and in the physical world. Our team is responsible for protecting both people and their data across intersections of the digital and physical world. The primary objective for Uber's Engineering Security team is to enable the technical ambitions of the company while maintaining the highest standards of security and privacy for our customers and partners.

As cybersecurity threats evolve, so do we.

Detection Engineering sits at the center of that mission. We own the end-to-end path from raw security telemetry to a high-fidelity, actionable case in a responder's hands - the detection content, the platforms that run it, and the signal quality our incident responders depend on. We ingest and normalize telemetry from every control plane at Uber - endpoint (EDR), identity, network, cloud, and AI-agent activity - and turn it into detections that fire fast enough and clean enough to matter.

Our mission is to protect, defend, and secure Uber's products, infrastructure, and data by building highly available, scalable, and extensible security solutions and services. We are focused on proactively identifying and remediating security risks as well as swiftly detecting and mitigating security incidents. In the ever-evolving landscape of cybersecurity, we continuously adapt and evolve our defenses in order to always stay one step ahead of potential threats.

We are seeking a talented and experienced Senior Manager to lead our Detection Engineering organization and own the strategy, roadmap, and execution for how Uber detects adversary activity at global scale. You will be accountable for detection coverage against a prioritized threat model, for the latency and fidelity of every signal we produce, and for the engineering platforms that make detection development a fast, testable, measurable discipline rather than an artisanal one.

This is a role for a leader who is as comfortable debating ATT&CK coverage gaps and false-positive economics with a staff detection engineer as they are setting a multi-half roadmap with Security Response, Threat Intelligence, Infrastructure, and Product partners. The security landscape is constantly evolving, and with the adoption of ML/GenAI backed by extensive heterogeneous data, both the threat surface and our detection toolkit are expanding rapidly.

With your deep expertise across detection, response, and large-scale data systems, you will lead major efforts to design, implement, and scale industry-leading detection capabilities. You are not only a role model, but also an empathetic leader - a humble teacher who grows engineers and managers while delivering uniquely challenging projects.

In this role you will define and execute the strategic roadmap for threat detection across Uber's corporate, production, and cloud environments. The scope includes:

• Detection strategy and coverage. Own a versioned, prioritized threat-scenario inventory (grounded in MITRE ATT&CK, intelligence-driven priorities, and newly emerging surfaces) and be accountable for provable detection coverage per scenario and environment, not anecdotal coverage claims.
• Detection content and detection-as-code. Lead the teams that author, test, tune, and retire detection logic across SIEM rules, batch/warehouse detections, behavioral and anomaly models, correlation logic, and vendor-native signals. Establish lifecycle standards: every detection has an owner, a mapped use case, test coverage, a documented response path, and measured performance.
• Detection platform and pipeline. Set direction for the ingestion, normalization, enrichment, and alerting infrastructure that detections run on - streaming and batch - including end-to-end observability of source freshness, completeness, mapping errors, and enrichment failures.
• Latency and fidelity…