Manager II, Security Incident Command

Manager II, Security Incident Command Department: Engineering Team: Security Engineer Location: New York, United States Type: Full-Time **About the Role** Uber’s Incident Command team, part of the Threat Defense and Response (TDR) organization, leads the coordination and response to the company’s highest-severity cybersecurity incidents, spanning threats, vulnerabilities, insider risks, and large-scale fraud. The team operates at the intersection of security, reliability, and engineering - across both digital and physical domains - applying disciplined incident management practices to complex, high-impact events. In this role, you will not only lead incident response but also drive its evolution by building and integrating automation and AI-powered systems across response, post-incident review, and proactive readiness programs. You will partner closely with Security, Infrastructure, Product, and Business teams to build a scalable, intelligent incident response ecosystem. Ultimately, you will help define how Uber responds to and prevents incidents - designing systems that augment human decision-making and strengthen resilience across the company. \-\-\-\- What the Candidate Will Do ---- 01. Incident Command Leadership 02. Lead a global team of incident commanders managing Uber’s highest severity security incidents 03. Drive structured, effective coordination across engineering, security, and business teams during high-impact events 04. Partner with Security, Legal, and Privacy on sensitive incidents requiring careful judgment and handling 05. Evolve incident management practices by integrating security IR and SRE/Ring0 disciplines 06. Proactive Programs 07. Own postmortem, premortem, and incident simulation programs to improve resilience and organizational readiness 08. Translate external incidents and emerging threats into actionable risk reduction across Uber 09. Engineering & AI Transformation 10. Build and integrate automation and AI-driven capabilities into incident response, postmortems, premortems, and incident simulations 11. Translate incident processes into scalable systems, defining