Note: The job is a remote job and is open to candidates in USA. DoorDash is hiring an Engineering Manager, Red Team to lead and grow its offensive security team while remaining hands-on in adversary simulation. The role sets red team strategy, guides technical engagements and tooling, and partners across security and engineering teams to drive remediation and improve defensive coverage.
Responsibilities
- Define the red team's strategic roadmap — engagement cadence, target prioritization, and capability development — aligned to DoorDash's threat landscape
- Lead, coach, and grow a team of offensive security engineers. Hire intentionally to fill capability gaps as the team scales
- Stay technically involved in engagement scoping, methodology, and tooling architecture. Guide adversary simulation, not just manage it
- Drive remediation outcomes cross-functionally — partner with detection/response, AppSec, infrastructure security, and product engineering to make sure findings get fixed, not just documented
- Build purple team workflows with detection engineering to validate and improve defensive coverage
- Direct the development of red team infrastructure and custom tooling as production-quality software
- Translate offensive findings into risk language that engineers, VPs, and non-technical stakeholders can act on
- Design repeatable processes and metrics that communicate the team's value in terms of risk reduction, not just finding count
Skills
- 7+ years of offensive security experience (red teaming, adversary simulation, penetration testing) with at least 3 years managing offensive security practitioners
- Deep, hands-on red team expertise — you speak fluently about TTPs, attack chains, tradecraft, and tooling because you've done the work, not just managed it
- Demonstrated player-coach balance between technical depth and management responsibilities
- Track record of shaping security strategy beyond your own team — influencing engineering, product, or infrastructure organizations to prioritize and act on findings, not just document them
- Experience with cloud-native offensive operations (AWS/GCP, Kubernetes, containerized microservices, CI/CD pipelines) and building or directing custom offensive tooling as engineered software, not just scripts
- People-first leadership — you coach, develop careers, provide honest feedback, and build team culture where offensive security practitioners grow
- Strong cross-functional influence — you can convince an engineering VP to allocate sprint capacity for remediation, partner with detection teams without being adversarial, and communicate the value of a red team in terms of risk reduction, not finding count
- Experience operating red teams at a marketplace, fintech, or logistics company at scale
- Background building or directing custom offensive tooling and C2 infrastructure
- Purple team experience — collaborative detection validation with blue team/DFIR partners
- Familiarity with threat intelligence-driven engagement scoping (mapping real adversary TTPs to organizational attack surface)
- Experience with global or distributed teams across time zones
- Relevant certifications: OSCP, OSCE, GXPN, CRTO, CRTL, or similar
Benefits
- 401(k) plan with employer matching
- 16 weeks of paid parental leave
- Wellness benefits
- Commuter benefits match
- Paid time off
- Paid sick leave in compliance with applicable laws
- Medical, dental, and vision benefits
- 11 paid holidays
- Disability and basic life insurance
- Family-forming assistance
- A mental health program
- For salaried roles: flexible paid time off/vacation, plus 80 hours of paid sick time per year.
- Equity grants
- Premium healthcare
- Wellness expense reimbursement
- Remote work in the United States
Company Overview
Company H1B Sponsorship