Lead Detection Engineer, Cloud Security & Automation

DoorDash, Inc.; Northern (KY); Hybrid; USD 160,000 - 235,000; Full time

Job summary

DoorDash, Inc. is seeking a senior detection engineer to design, tune, and maintain detection content across cloud, endpoints, and the marketplace.

You will partner with incident response, insider risk, and threat intel teams to reduce alert volumes while increasing fidelity, building agentic tooling and scalable detections. You will lead detection engineering projects, contribute to a modern data platform, and participate in on-call rotations.

Qualifications

• 7+ years of experience in secure coding, alert development, and detection engineering.
• Direct experience building, maintaining, and operating a detection-as-code pipeline.
• Proven automation that measurably improved detection accuracy, velocity, or quality.
• Experience building agents to solve detection problems efficiently.
• Extensive knowledge of cloud-based and distributed systems.
• Experience with global cross-functional partners (IR, insider risk, threat hunting).
• Mastery of SIEM querying and programming languages (Python, Go, SQL, SPL, KQL).
• Experience mapping MITRE ATT&CK/D3FEND to detection coverage.
• Excellent verbal and written communication and stakeholder management.
• Familiarity with Snowflake, Cortex, and Google SecOps is preferred.

Responsibilities

• Conduct hands-on detection engineering for custom alerting and risk-based analytics.
• Integrate external signals into alerting pipelines for specific use cases.
• Develop and maintain agentic tooling to improve detection efficacy.
• Leverage logs and telemetry to build detections at scale.
• Work with telemetry to produce meaningful security signals.
• Maintain detection repositories, use case libraries, and optimize content.
• Coordinate with cross-functional teams on threats targeting DoorDash.
• Lead projects that improve security posture across DoorDash brands.
• Create standards and documentation to improve service consistency.
• Mentor and uplevel other Cyber Defense engineers; participate in on-call rotation.

Skills

Security engineering

Detection engineering

Alert development

Automation in detection

Cloud knowledge

Cross-functional partners

SIEM queries

MITRE ATT&CK/D3FEND

Communication skills

Snowflake Cortex Google SecOps

Tools

Snowflake

Cortex

Google SecOps

Job description

DoorDash, Inc. is seeking a senior detection engineer to design, tune, and maintain detection content across cloud, endpoints, and the marketplace.

You will partner with incident response, insider risk, and threat intel teams to reduce alert volumes while increasing fidelity, building agentic tooling and scalable detections. You will lead detection engineering projects, contribute to a modern data platform, and participate in on-call rotations.