This listing doesn't post a salary. Most similar roles pay
$152,112–$215,925.
Based on 240 similar postings.
Employer
About Uber
Uber Technologies, Inc. is the world’s largest, San Francisco-based mobile technology platform facilitating on-demand ride-hailing, food delivery (Uber Eats), and freight transportation across approximately 70 countries.
Staff Security Strategist GRC joins the Tech Risk and Assurance team within Engineering Security to strengthen cybersecurity posture through scalable risk management, governance, and control design. This role operates at the intersection of technical security and process design, where the individual translates complex threat contexts and compliance requirements into actionable treatment plans for engineering teams. Key responsibilities include managing the ServiceNow eGRC platform, developing product strategies for risk tools, automating workflows, and building performance dashboards to track key risk indicators. The candidate will collaborate with developers to implement UI actions and scripts while ensuring security risks become practical engineering actions. Required skills include expertise in GRC frameworks like NIST CSF or ISO 27001, along with proficiency in Python, SQL, and data analysis to improve reporting and automate risk management processes across the organization.
Manage cyber risk intake, triage, and prioritization to ensure clear accountability and timely treatment decisions.
Develop product strategy and lead execution for Risk and Compliance technology solutions on the ServiceNow eGRC platform.
Partner with engineering teams to define risk treatment plans and drive technical remediations to completion.
Gather functional requirements from stakeholders to develop technical specifications and deliver high-quality software products.
Lead control design reviews, risk assessments, and complex decision-making involving stakeholder alignment and trade-offs.
Automate risk workflows and improve system capabilities by analyzing user stories and internal procedures.
Build and maintain risk reporting dashboards, including Key Risk Indicators (KRIs) and exposure trends for leadership.
Mentor junior security partners on risk analysis, treatment planning, and operational rigor.
What we're looking for
Bachelor's or Master's degree in Computer Science, Engineering, Information Systems, Cybersecurity, Risk Management, or a related field, or equivalent practical experience.
10+ years of experience in security, cyber risk, GRC, assurance, security operations, or related technical risk roles.
Security certifications such as CISA, CISSP, CISM, or other relevant certifications.
Demonstrated success managing security risk programs, treatment decisions, and cross-functional execution end to end.
Strong understanding of security controls, risk treatment, and engineering implementation details.
Excellent written and verbal communication skills for presenting to leadership and technical audiences.
Experience with ServiceNow eGRC platform, other GRC/ERM tools, or Big 4 accounting firm experience (preferred).
Proficiency in Python, SQL, data analytics, automation, or knowledge of frameworks like NIST, ISO, and SOC 2 (preferred).