Senior Security Engineer, Proactive Security - Platform

doordashusa; United States; Remote; USD 150,000 - 210,000; Full time

Job summary

DoorDash is seeking a Senior Security Engineer to join a proactive security platform team. You will design and operate core services that help engineers access infrastructure, manage secrets, and authenticate workloads securely.

The role emphasizes self-service tools and tight integration with Kubernetes, CI/CD, and cloud environments, while maintaining high reliability and broad on-call coverage. You will work remotely within the United States and participate in a global on-call rotation,

Qualifications

• 6+ years in security, infra, or platform engineering in a large-scale internet environment.

Responsibilities

• Design and strengthen workflows for privileged access, secrets management, and identity services.
• Threat model, review, and test security services and integrations; drive remediation.
• Build self-service tools, SDKs, and integrations for temporary access and credentials.
• Lead migrations away from persistent credentials and standing access to reduce exposure.
• Integrate security workflows with Kubernetes, CI/CD, and cloud IAM in collaboration with infra and product teams.
• Support operations with monitoring, runbooks, incident response, and on-call; secure AI agent access and secrets usage.

Skills

Security engineering

Go/Java/Kotlin

Access management

Identity standards

Kubernetes

Infrastructure as code

AWS/GCP IAM

Education

Degree in a related field

Tools

Kubernetes

Terraform

HashiCorp Vault

Teleport

Job description

Role overview

As a Senior Security Engineer on a proactive security platform team, you will build and operate core services that help engineers access infrastructure, manage secrets, and authenticate workloads securely. The focus is on making secure practices easy to adopt through self-service tools and integrations, while keeping critical services resilient and well operated. The role is remote within the United States and includes participation in a global on-call rotation.

Responsibilities

• Design and strengthen standard workflows for privileged access, secrets management, and identity services.
• Threat model, review, and test critical security services and their integrations, then drive identified issues through remediation.
• Build self-service tools, SDKs, infrastructure modules, and integrations for temporary access and credentials.
• Lead migrations away from persistent credentials and standing access, measuring progress by reduced exposure.
• Integrate security workflows with Kubernetes, CI/CD, and cloud environments in partnership with infrastructure and product engineering teams.
• Support service operations through monitoring, runbooks, incident response, root cause analysis, and follow-the-sun on-call; help secure AI agent access and secrets use.

Requirements

• At least six years of security, infrastructure, or platform engineering experience in a large-scale internet environment.
• Strong software engineering skills in an object-oriented language such as Go, Java, or Kotlin, including production security tooling or services.
• Hands-on experience with access management, secrets management, or key management systems.
• Working knowledge of identity and authentication standards such as OIDC, SAML, mTLS, or workload identity.
• Familiarity with distributed systems, Kubernetes, infrastructure as code, and AWS or GCP identity and access management.
• Experience with threat modeling, security design reviews, incident analysis, and operating highly available services; degree in a related field or equivalent experience.

Nice to have

• Experience with Teleport or HashiCorp Vault.