Threat Detection Engineer — Protective Services

DoorDash USA; United States; Remote; USD 131,000 - 192,000; Full time

Benefits offered by this job

401(k) matching

Parental leave

Wellness benefits

Commuter benefits

Paid time off

Paid sick leave

Health insurance

Job summary

DoorDash is seeking a Detection Engineer for Protective Services to build and refine production threat detections across identities, endpoints, cloud, and marketplace data. You’ll drive detections from hypothesis to deployment, tuning them based on real-world feedback and cross‑functional input.

You’ll partner with senior engineers, apply analytics and ML/LLM techniques where relevant, and contribute to automation, testing, and documentation to strengthen detection reliability.

Qualifications

• 3+ years in detection engineering, threat hunting, incident response, or security-focused software engineering.
• Experience building production detection pipelines with source control, testing, and deployment.
• Proficiency in SQL and ability to write maintainable Python/Go code.
• Strong analytical skills and ability to turn threat data into testable hypotheses.
• Experience triaging alerts, correlating signals, and communicating findings.
• Experience building detections or investigations using security telemetry across data sources.
• Knowledge of automation to improve workflows; ML/LLM familiarity is a plus.
• Familiarity with MITRE ATT&CK and D3FEND frameworks.

Responsibilities

• Translate threat intel and incidents into production detections with actionable context.
• Build, test, deploy, tune, and maintain detections and pipelines at scale.
• Correlate signals across telemetry, marketplace activity, and OSINT to identify threats.
• Investigate detections by querying data, validating hypotheses, and assessing impact.
• Collaborate on reviews, testing, documentation, and automation to improve reliability.

Skills

Detection engineering

Threat hunting

Incident response

Security operations

SQL

Python

Go

Analytical skills

Alert triage

Automation

MITRE ATT&CK

D3FEND

Snowflake

Cortex

Google SecOps

Education

Bachelor's degree

Tools

Snowflake

Cortex

Google SecOps

Job description

DoorDash is seeking a Detection Engineer for Protective Services to build and refine production threat detections across identities, endpoints, cloud, and marketplace data. You’ll drive detections from hypothesis to deployment, tuning them based on real-world feedback and cross‑functional input.

You’ll partner with senior engineers, apply analytics and ML/LLM techniques where relevant, and contribute to automation, testing, and documentation to strengthen detection reliability.