Sr Manager, Security Engineering - Engineer

• Detection strategy and coverage. Own a versioned, prioritized threat-scenario inventory (grounded in MITRE ATT&CK, intelligence-driven priorities, and newly emerging surfaces) and be accountable for provable detection coverage per scenario and environment, not anecdotal coverage claims.

• Detection content and detection-as-code. Lead the teams that author, test, tune, and retire detection logic across SIEM rules, batch/warehouse detections, behavioral and anomaly models, correlation logic, and vendor-native signals. Establish lifecycle standards: every detection has an owner, a mapped use case, test coverage, a documented response path, and measured performance.

• Detection platform and pipeline. Set direction for the ingestion, normalization, enrichment, and alerting infrastructure that detections run on - streaming and batch - including end-to-end observability of source freshness, completeness, mapping errors, and enrichment failures.

• Latency and fidelity as hard goals. Drive measurable, time-bound improvements in time-to-detect for the highest-priority scenarios, and in signal-to-noise for the response queue. Recover responder capacity by eliminating low-value alerting without degrading true-positive rate.

• AI/ML for cyber defense. Lead the responsible adoption of ML and LLM-based techniques for detection, triage, correlation, and case enrichment — moving them from research to production with fairness, safety, auditability, and compliance built into the engineering practice.

• Partner with response. Operate in tight feedback loop with Security Response & Investigations, Threat Intelligence, and the SOC so detection quality is measured by investigative outcomes, not rule counts. Act as a senior escalation point during high-severity events and drive detection gaps surfaced in post-incident review back into the roadmap.

• Cross-functional influence. Collaborate with Infrastructure, Corporate IT, Identity, Product Engineering, Legal, and Privacy to secure telemetry access, land instrumentation at the source, and integrate detection into systems and development lifecycles across Uber.

• Build and lead the team. Manage a team of highly skilled security and software engineers — including senior/staff ICs and, over time, managers and tech leads — fostering a culture of technical excellence, operational rigor, continuous improvement, and strong customer focus. Set clear, ambitious goals to hire, develop, and retain a diverse and inclusive team, and deliver against them.

• Vendor and build/buy strategy. Evaluate, select, and manage relationships with external security vendors and platforms; make and defend complex build-vs-buy and cost-vs-coverage tradeoffs with a clear view of short- and long-term implications.

1. Bachelor's Degree or equivalent in Computer Science, Engineering, Information Security, or a related technical field.

2. 5+ years of full-time work experience in software engineering or security engineeringprior to Engineering Management experience.

3. 5+ years of full-time Engineering Management experience, including experience leading senior/staff engineers and growing other leaders (managers and/or tech leads).

4. Demonstrable domain expertise owning complex detection and response programs: threat detection, detection engineering, SIEM/security analytics, incident response, or security data platforms at enterprise or cloud scale.

5. Proven track record of setting multi-team technical strategy and delivering against it over multiple planning cycles, with measurable outcomes in coverage, time-to-detect, or alert quality.

6. Ability to make complex decisions with incomplete information in ambiguous situations and environments, and to hold accountability for those decisions.

7. Great interpersonal skills, deep technical ability, and a track record of successful execution in security engineering or software development at cloud scale.

8. Excellent written and verbal communication, with the ability to convey detection strategy, systemic risk, and tradeoffs to both executive leadership and senior engineers.

1. Master's Degree or PhD in Computer Science, Engineering, Information Security, or a related field.

2. Hands-on background in detection engineering: authoring and tuning detection logic across log, network, endpoint, identity, and cloud telemetry, with a track record of improving coverage and signal fidelity while reducing false-positive burden on responders.

3. Experience operating a modern detection stack at scale — SIEM/security data lake (e.g., Elastic, Splunk), streaming pipelines (e.g., Kafka, Flink), warehouse-based batch detections, EDR (e.g., CrowdStrike, SentinelOne), CNAPP/CDR (e.g., Wiz), identity providers (e.g., Okta), and SOAR/case management (e.g., Torq).

4. Experience with public cloud security across multiple providers (GCP, OCI, AWS) and modern containerized/orchestrated environments.

5. Experience incorporating AI/ML and LLM-based techniques into production security systems, including evaluation methodology and precision/recall management.

6. Experience partnering with EMs, TPMs, and PMs on prioritization, headcount planning, and technical evaluation of team members.

7. Experience leading teams across multiple locations and working across multiple in-house engineering organizations.

8. Familiarity with relevant industry frameworks and compliance mandates (e.g., MITRE ATT&CK, NIST CSF, ISO 27001, SOC 2).

For Seattle, WA-based roles: The base salary range for this role is USD $267,000 per year - USD $297,000 per year.

You will be eligible to participate in Uber's bonus program, and may be offered an equity award & other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits.