Senior Detection Engineer

doordashusa; USA; Remote; USD 170.000 - 230.000; Vollzeit

Zusammenfassung

DoorDash is seeking a Senior Detection Engineer to lead the design and tuning of detection content across a globally distributed cyber defense organization. You will work at the intersection of threat intel, incident response, and security automation, ensuring coverage across cloud, endpoints, identity systems, and the marketplace platform.

The role includes participating in an on-call rotation and reporting to a senior cyber defense manager.

Qualifikationen

• 7+ years of experience in secure coding, alert development, and detection engineering.
• Direct experience building, maintaining, and operating a detection-as-code pipeline.
• Proven success in building automation that improves detection accuracy, velocity, or quality.
• Experience building agents or autonomous tooling to solve detection problems.
• Extensive knowledge of cloud-based and distributed systems.
• Mastery of SIEM query languages (SQL, SPL, or KQL) and programming in Python or Go.
• Experience mapping detections to MITRE ATT&CK and D3FEND.

Aufgaben

• Design, implement, and maintain risk-based analytics and high-fidelity alerting tailored to specific use cases.
• Integrate external threat intelligence signals into detection pipelines.
• Develop agentic tooling and automation that measurably improves detection efficacy and efficiency.
• Engineer detections at scale using security telemetry, logs, and custom data sources.
• Manage detection repositories, use case libraries, and ongoing content optimization.
• Coordinate with incident response, insider risk, threat hunting, and data pipeline teams on cross-functional detection projects.
• Mentor engineers and contribute to documentation, standards, and on-call operations.

Kenntnisse

Detection engineering

Detection-as-code

Threat intelligence

Automation tooling

Cloud-based systems

SIEM queries (SQL SPL KQL)

Programming (Python or Go)

Tools

Snowflake

Cortex

Google SecOps

Jobbeschreibung

Role overview

A senior detection engineer is needed to lead the design, tuning, and continuous improvement of detection content within a globally distributed cyber defense organization. The position sits at the intersection of threat intelligence, incident response, and security automation, with responsibility for building detection coverage across cloud infrastructure, corporate endpoints, identity systems, and a multi-sided marketplace platform. The role requires participation in an on-call rotation and reports to a senior cyber defense manager.

Responsibilities

• Design, implement, and maintain risk-based analytics and high-fidelity alerting tailored to specific use cases
• Integrate external threat intelligence signals into detection pipelines
• Develop agentic tooling and automation that measurably improves detection efficacy and efficiency
• Engineer detections at scale using security telemetry, structured and unstructured logs, and custom data sources
• Manage detection repositories, use case libraries, and ongoing content optimization
• Coordinate with incident response, insider risk, threat hunting, and data pipeline teams on cross-functional detection projects
• Mentor engineers and contribute to documentation, standards, and on-call operations

Requirements

• 7+ years of experience in secure coding, alert development, and detection engineering
• Direct experience building, maintaining, and operating a detection-as-code pipeline
• Demonstrated success building automation that improved detection accuracy, velocity, or quality
• Experience building agents or autonomous tooling to solve detection problems
• Extensive knowledge of cloud-based and distributed systems
• Mastery of SIEM query languages such as SQL, SPL, or KQL, plus programming proficiency in Python or Go
• Experience mapping detections to frameworks like MITRE ATT&CK and D3FEND
• Strong written and verbal communication, presentation, and stakeholder management skills

Nice to have

• Hands-on experience with Snowflake, Cortex, or Google SecOps platforms