Change is the Only Constant: Lessons Learned from Uber

Every job has its challenges. While Uber has seen its share during the past few years, it has been an inspiring place to work and see an organization grow on a global scale. We’ve had to learn a lot along the way, and I’ve been constantly challenged—but never have I felt more passionate or fulfilled by coming to work every day. Below are a few of the hard-earned lessons I've learned during my time at Uber—many of which other security leaders could apply to their own roles, whether as similar fast-moving disruptors or industry stalwarts.

Be a Problem Solver

When I joined the company, it was a leap of faith. I was leaving a comfortable position at Facebook for a somewhat nebulous role on the Trust & Safety team at Uber, which was growing at unprecedented speed. There wasn’t a standalone security function at the time, but what drew me to the opportunity was the fact that Uber had problems that I knew how to solve. I didn’t get stuck on title, level, or organizational structure, and instead focused on ways I could use my skills and knowledge to add value and deliver solutions.

I didn’t fully understand the scope and breadth of the challenge that Uber’s scale would present until I dug in. My focus was on solving the most important issues for the business, and doing that again, and again, and again. That approach quickly created a positive business impact, which led to growth in scope and influence, and eventually led to a promotion.

Get Comfortable with Being Uncomfortable

In an environment as dynamic as Uber, you will never feel comfortable in your role. At Facebook, and before that in the U.S. Secret Service, I eventually hit a groove where even on challenging days I knew what to expect and how to navigate the system. At Uber, I’ve become a lot more comfortable navigating the unknown.

What I realized about halfway into my tenure was that my role evolved about every six months. Just when I felt like I knew what it took to be successful, there would be a major shift that required me to rethink my strategy, adjust my approach, and ultimately focus my time in a different way. I’m used to being really good at my job, but inevitably, when things evolve that quickly there is going to be a learning curve. Getting comfortable with being on that learning curve and embracing the lesson in every misstep helped me amplify my learnings and impact.

Be Honest

I’ve never been a good liar. I’m a terrible poker player. And I am usually the person who gives my honest opinion in meetings, even if it conflicts with the majority’s view or ruffles some feathers. It’s hard for most to speak up in moments where you’re the minority viewpoint, but in these moments in my time at Uber I have had the greatest impact.

I have also had to be honest with myself—when I need to ask for help, when I need to ask for feedback, and when I need to ask for credit on a job well done. The willingness to be honest, humble, and direct has served me well.

Value Your Team

For me, people come first. The best part about my job is the people I work with. After five years, which sometimes feels like a lifetime, when I think back on my best moments and the things I’m most proud of and grateful for, they revolve around shared successes and experiences with my team. I tell the team often: we have the privilege and responsibility to create our own dream team. In five more years when we reflect back, we won’t remember the ups and downs, we’ll remember how great it was to be a part of something bigger than ourselves, where we were valued and trusted, and where together we helped to change the world.

To show your team members that they are valued requires a healthy mix of personal commitment and self-reflection as a leader; instilling a culture of flexibility, tolerance for taking risks, learning from failures, and iterating with the intent to constantly improve; frequent communication and a willingness to listen; and empathy, which has been especially important in 2020. A few concrete examples include creating venues to listen to ideas, input, and feedback from staff; prioritizing their personal health and safety by encouraging breaks and a sustainable operating pace; low-dose, high-frequency feedback in honor of constant improvement; and recognition and praise for a job well done.

Show Your Team’s Value

Most businesses consider the security team an operating expense and nothing more. Of course there is an operational cost to security, but it’s a missed opportunity to accept the premise that security cannot generate value for the business or support its strategy and goals. Changing how security is viewed and valued was a big focus for me at Uber. That meant taking a few key steps:

Using data to drive decision making. Number of guarding hours per month is not a compelling stat, and it doesn’t reflect the value/ROI of an onsite security presence. Identifying trends in security incidents at a site over time and demonstrating—with data—how targeted measures helped reduce those incidents, becomes a more compelling, data-driven narrative around the value of the investment. This was critical for a company like Uber, where our different lines of business are complex and present their own unique security challenges; where our footprint is global and security support is culturally nuanced; and where our workplaces vary from offices to data centers to in-person customer support hubs.

Becoming truly data-driven didn’t happen overnight. It required buy-in from across the team, including on-site guards managing and reporting incidents, security center operators triaging incidents, data analysts ensuring data integrity and identifying incident trends, and security managers using these data insights to brief business stakeholders.

Developing security metrics that we could translate into business impact. When speaking with our partners outside of the security team, we had to engage in a language they understood. Oftentimes, that’s dollars, but it can also be growth, category position, market cap, etc. Once we had a strong foundation of security data, finding ways to translate that into business metrics was a great opportunity to ensure the value of our work was better understood across teams.

One example here was helping the business understand the severity of security incidents and crises, like natural disasters, and how these events can cause business disruptions that result in significant financial loss—unless a contingency plan is in place.

Aligning the team priorities and resources to support strategic business goals. We focused on the ways security enables the business and opportunities where skills within the security team (crisis response, decisiveness, contingency planning, threat analysis, etc.) supported a partner team’s needs. The COVID-19 pandemic was unprecedented and presented a variety of new, complex challenges, but we relied on experience to ensure our response was robust and efficient—yet nuanced and employee-focused—as we tackled complex issues like safe PPE distribution for our earners, contact tracing at our offices, or 24/7 monitoring of public health orders and government mandates to ensure Uber operations were compliant.

Never Lose Sight of Your Mission

Protecting our people is our top priority at Uber; all else is secondary. It was important that we emphasized this message with the business and each other regularly. Doing so helped us better prioritize our time and resources and ensure that we never lost sight of the human element that drives Uber’s success.

The security team constantly strives for new efficiencies or automated solutions, and we are committed to providing support that is accessible, empathetic, and considers the diversity of our global workforce and customers. We think this approach is critical in earning trust, and that when staff feel safe and supported, and believe Uber is truly invested in their well-being, their commitment to the company’s mission is strengthened and their job satisfaction is high.

Don’t Measure Your Success Through News Headlines

A company like Uber makes the news, however, rarely has a news headline accurately captured what I was experiencing within my team. In some of the company’s tougher public moments, we were doing our best work on the security team.

It’s impossible to completely tune out the news. Inevitably, friends and family are going to ask you about the headlines—especially the bad ones—but they don’t have to be the measuring stick of your success. Can you point to work you’ve done that’s helping people? Do you have a clear mission that you are delivering on? And do you have a team of people that you’re proud to be part of? I think those are pretty good signs that you’re doing ok.

Carla Gray joined Uber Technologies, Inc. in 2015 to create and scale the security function from the ground-up, ultimately rising to the position of Global Security Director within the Trust & Security organization. During her five and a half years at Uber, she built a security model to support the business through periods of unprecedented hyper-growth, successful entry into heavily regulated and complex international markets, competitive M&A activities, and historically significant corporate transformations. Currently Gray is head of safety and security at Epic Games. She is a graduate of York College with a B.S. in Criminal Justice, and a graduate of the Executive Leadership Program at the Naval Postgraduate School’s Center for Homeland Defense and Security.