Senior Detection Engineer, Protective Services

This is a fully remote position, open to applicants in United States.

📋 Description

• Engage in practical detection engineering for Protective Services.

• Convert threat intelligence, investigative requirements, incidents, and observed behaviors into tailored alerting systems.

• Apply risk-based analytics to minimize alert volume and focus on significant threats.

• Design, test, implement, and manage detection-as-code pipelines.

• Integrate enterprise telemetry, marketplace activities, physical security events, OSINT, support interactions, and external signals.

• Utilize rules, statistical techniques, machine learning, and LLM-driven strategies for detection and investigation.

• Create and uphold automation and agentic tools.

• Oversee the detection lifecycle from hypothesis and data validation to deployment, tuning, measurement, and retirement.

• Maintain detection repositories and use case libraries.

• Conduct technical triage and investigations, correlating signals across various sources.

• Follow detections through the phases of investigation, response, and mitigation.

• Collaborate with internal and external partners on threats directed at DoorDash.

• Lead initiatives that enhance protective capabilities across DoorDash brands.

• Develop and uphold engineering standards, testing protocols, and documentation.

• Mentor and assist fellow engineers through technical reviews and collaborative efforts.

• Participate in the on-call rotation and provide support for critical protective cases.

• Report directly to the Engineering Manager of Protective Services.

⛳️ Requirements

• Over 7 years of experience in detection engineering, alert creation, threat hunting, incident response, security operations engineering, technical threat intelligence, or software engineering related to security challenges.

• Hands-on experience in building, maintaining, and operating production detection-as-code pipelines using source control, testing, review, deployment, and monitoring practices.

• Demonstrated success in developing automation that enhances detection accuracy, speed, or investigative quality.

• Experience in creating agents or LLM-enhanced tools for detection or investigation, including assessing quality, reliability, and failure modes.

• Strong investigative judgment with the capacity to transform incomplete threat data into testable hypotheses.

• Background in constructing detections across varied security or behavioral datasets.

• Familiarity with marketplace activities, physical access, alarms, video, OSINT, or support-interaction telemetry.

• In-depth knowledge of cloud-based and distributed systems.

• Experience working with global and cross-functional teams.

• Proficient in SQL or SIEM query languages like SPL or KQL.

• Skilled in writing maintainable code in Python, Go, or another relevant programming language.

• Familiarity with MITRE ATT&CK, D3FEND, or similar frameworks.

• Exceptional communication, presentation, and stakeholder management abilities.

• Sound judgment regarding sensitive information.

• Dedication to mentoring fellow engineers.

• A bachelor’s degree or equivalent practical experience.

• Experience with Snowflake, Cortex, or Google SecOps is a plus.

🏝️ Benefits

• Equity grants.

• 401(k) plan with employer matching.

• 16 weeks of paid parental leave.

• Wellness benefits.

• Commuter benefits match.

• Flexible paid time off/vacation.

• Paid sick leave; salaried roles receive 80 hours annually.

• Medical, dental, and vision benefits.

• 11 paid holidays.

• Disability insurance.

• Basic life insurance.

• Family-forming assistance.

• Mental health program.

• Premium healthcare.

• Wellness expense reimbursement.

• Accommodation support for applicants.