About the Role

Uber's Engineering Security organization runs several high-volume, high-judgment programs: design-time AI security and privacy reviews, a security champions network, AI red teaming, AI agent governance, and the standards that define how AI is built and used inside the company.

We're hiring a Sr. TPM to operate across these programs, raise the bar on execution, and scale them through automation.

This role exists because these programs intersect in ways no single workstream owns. A red team finding should sharpen the next design review. A new guardrail should be measured for both security value and developer friction. A standard should be written so the people who must apply it can actually apply it. Connecting these threads and turning that visibility into measurable improvements is the core of the job.

You'll work in an AI-native environment. We've built internal agents that handle routine triage, assignment, and reporting. You'll be expected to use it daily, identify where it can be extended, and partner with engineering to keep it accurate over time. Comfort building and improving AI workflows is a strong differentiator.

This is a high-visibility role with a broad surface area across security engineering, AI governance, and platform programs. The TPM in this seat partners directly with senior security and engineering leaders and shapes how AI is governed across Uber's engineering organization.

What the Candidate Will Need / Bonus Points - What the Candidate Will Do -

AI agent oversight

• Drive cross-functional review of new and updated security standards, gathering input from senior engineers, AI/ML stakeholders, IAM, AppSec, OffSec, legal, and Product Security.
• Support the operating cadence for AI agent inventory and governance, ensuring agents move through review, approval, and ongoing oversight in line with internal standards and external regulatory expectations.
• Coordinate intake and follow-through for AI red teaming and threat modeling activities, ensuring findings are routed to the right remediation owners and reflected back into review criteria.

Security & privacy review program operations

• Run the day-to-day of the engineering security and privacy review program: intake, routing, capacity planning, SLA tracking, and escalation.
• Maintain accurate, trustworthy program metrics. Define what's worth measuring, validate the data, and report cleanly to leadership.
• Drive timely, well-documented closure of reviews so the program produces a defensible audit trail.
• Monitor AI-assisted triage and assignment workflows for accuracy. Track false positive and false negative rates, identify drift, and partner with engineering to keep the automation calibrated.
• Support review quality through sampling, feedback loops, and reviewer calibration.

Security champions network

• Own the champions lifecycle end-to-end: recruitment, training scheduling, certification tracking, and ongoing engagement.
• Improve recognition, satisfaction measurement, and visibility for champions' contributions to their performance reviews.
• Report on coverage, training throughput, and certification status by line of business.

Cross-program analysis and improvement

• Identify patterns and gaps that are only visible from a cross-program vantage point, and turn them into concrete improvements.
• Translate outputs from one program into inputs for another (e.g., red team findings into review criteria; review trends into champion training topics).
• Propose, scope, and ship process improvements with clear before/after metrics.

AI-assisted execution

• Use existing internal AI tooling to scale your own throughput and the program's.
• Identify where automation is missing or imperfect, and partner with engineering to extend it.
• Help shape how AI tooling is applied across the program - assignment, triage, reporting, and quality checks.

Executive reporting

• Own recurring operational reporting to senior leadership: identify contributors, set deadlines, drive contributions, and assemble the final deliverable.

- Basic Qualifications -

• 4+ years as a TPM, Program Manager, or equivalent in a software or technology environment.
• Strong analytical skills: you see patterns in data and operational signals that others miss, and turn those observations into action.
• Excellent written and verbal English.
• Strong follow-through. You drive things to completion across multiple stakeholders without needing to be reminded of status.
• JIRA proficiency: JQL, dashboards, automation rules, sprint management.
• Daily use of AI tools (Claude, ChatGPT, etc.) as productivity accelerators or demonstrated ability to ramp up within four weeks.
• Self-directed across time zones; comfortable making decisions with incomplete information.
• Skilled at driving alignment across teams without formal authority.

- Preferred Qualifications -

• Experience supporting security, privacy, compliance, risk, or audit programs.
• Familiarity with security review, privacy review, threat modeling, or risk assessment workflows.
• Experience with AI governance, responsible AI, LLM applications, AI agents, or AI security programs.
• Experience improving workflow automations using AI tools, scripts, JIRA automation, APIs, or low-code tooling.
• Experience running training, certification, champion, or distributed reviewer programs.
• Comfort with CLI tools and lightweight scripting.
• Familiarity with regulatory or audit-sensitive environments where documentation quality and evidence readiness matter.