Threat Detection Engineer - Protective Services

DoorDash, Inc.; San Francisco (CA); On-site; USD 131,000 - 192,000; Full time

Benefits offered by this job

401(k) plan with employer matching

16 weeks of paid parental leave

Wellness benefits

Commuter benefits match

Paid time off & paid sick leave

Medical, dental, and vision benefits

Job summary

DoorDash is seeking a Detection Engineer for Protective Services. You will build detections across identities, endpoints, cloud, and physical security signals, moving from hypothesis to deployment. You’ll work with engineers to target meaningful risk while reducing noise and maintaining scalable pipelines.

You’ll join a hands-on team focusing on detection enrichment, automation, and continuous improvement. The role reports to the Engineering Manager, Protective Services, and participates in

Qualifications

• 3+ years of experience in detection engineering, threat hunting, incident response, security operations, or related security software engineering.
• Experience contributing to production detection pipelines using source control, testing, review, deployment, and monitoring practices.
• Proficiency in SQL or a security query language and ability to write maintainable code in Python, Go, or similar language.
• Strong analytical skills to explore unfamiliar datasets, assess data quality, and turn threat info into testable hypotheses.
• Experience triaging alerts/investigations, correlating signals across data sources, and communicating evidence.
• Experience building detections or investigations using security, behavioral telemetry, or related data; exposure to identity, endpoint, cloud, OSINT, or physical security is a plus.
• Experience using automation/analytics to improve detection and investigation workflows; ML/LLM familiarity a plus.
• Familiarity with MITRE ATT&CK or D3FEND frameworks for coverage mapping.
• Strong collaboration and communication across engineering, investigative, and response teams; handling sensitive information.
• Bachelor’s degree or equivalent practical experience.
• Experience with Snowflake, Cortex, or Google SecOps preferred.

Responsibilities

• Translate threat intelligence, incidents, and observed behavior into production detections.
• Build, test, deploy, tune, and maintain detections and supporting pipelines.
• Correlate signals across enterprise telemetry, marketplace activity, and other data to identify threats.
• Apply rules, statistical methods, ML, and LLM-based techniques to improve detection quality.
• Investigate detections by querying and correlating data; validate hypotheses and assess impact.
• Follow detections through investigation and resolution; refine logic and tooling from real-world findings.
• Contribute to technical reviews, testing, documentation, standards, and automation to strengthen reliability.

Skills

Detection engineering

Threat hunting

Incident response

Security operations

SQL

Python

Go

Data analysis

MITRE ATT&CK

Collaboration

Education

Bachelor's degree or equivalent

Tools

Snowflake

Cortex

Google SecOps

Job description

DoorDash is seeking a Detection Engineer for Protective Services. You will build detections across identities, endpoints, cloud, and physical security signals, moving from hypothesis to deployment. You’ll work with engineers to target meaningful risk while reducing noise and maintaining scalable pipelines.

You’ll join a hands-on team focusing on detection enrichment, automation, and continuous improvement. The role reports to the Engineering Manager, Protective Services, and participates in