Note: The job is a remote job and is open to candidates in USA. DoorDash is a technology and logistics company operating a delivery marketplace supported by a global cyber defense team. The Senior Security Data Engineer will own high-volume security telemetry pipelines across AWS and GCP, including data modeling, cost and query optimization, reliability, infrastructure as code, and CI/CD. The role also involves building automation and AI agents, enforcing cloud workload governance, leading cross-functional projects, participating in on-call rotation, and mentoring engineers.
Responsibilities
- Own multi-terabyte-per-day log pipelines across AWS and GCP: ingest, routing, enrichment, schema management, and onboarding new sources as the business adds them
- Control ingest cost and volume, cutting noise at the edge without dropping the audit logs investigators depend on
- Model security data and tune query performance in Snowflake, BigQuery, and Redshift, including the tables detection engineering builds on
- Ship production services and integrations that other teams depend on: custom SIEM connectors, API clients, and automation
- Set and defend SLOs for log availability and freshness, and build the dashboards and alerting that prove them
- Own infrastructure as code and CI/CD for all of the above, including the deployment path that detections-as-code rides on
- Build AI agents and automated runbooks that speed up triage and time to fix across cloud infrastructure
- Enforce IAM and service account governance for the pipeline's cloud workloads
- Lead cross-functional projects spanning infrastructure, platform engineering, and incident response
- Create and maintain the standards and documentation that keep the service consistent, and mentor engineers across Cyber Defense
Skills
- 5+ years building and operating high-volume data pipelines in production at multi-terabyte-per-day scale, with tools like Kafka, Cribl, Dataflow, Kinesis, or CloudWatch
- 4+ years writing production software in Python, Go, Rust, or Java: services and tooling that other engineers run, beyond one-off scripts
- Deep hands-on experience with AWS and GCP, including infrastructure as code and ownership of CI/CD pipelines on GitHub, GitLab, or Bitbucket
- Strong SQL and data modeling in a columnar warehouse such as Snowflake, BigQuery, or Redshift, covering partitioning, cost control, and query tuning
- A track record owning reliability for a platform other engineers depend on, including on-call
- Experience building executive dashboards and engineering metrics that people actually act on
- Proven leadership and technical project management across infrastructure, platform engineering, and incident response
- Exceptional written and verbal communication, a collaborative instinct, and a habit of continuous learning
- Familiarity with an enterprise SIEM as an operator or a consumer (Google SecOps/Chronicle, Splunk, Elastic, CrowdStrike LogScale)
- Time with Kubernetes, Docker, and runtime security controls
- Any hands-on time with security telemetry sources, detections-as-code (YARA-L, Sigma, SPL), LLM-assisted workflows, penetration testing, red teaming, or triaging bug bounty reports
Benefits
- Opportunities for equity grants
- A 401(k) plan with employer matching
- 16 weeks of paid parental leave
- Wellness benefits
- Commuter benefits match
- Paid time off
- Paid sick leave in compliance with applicable laws (e.g. Colorado Healthy Families and Workplaces Act)
- Medical, dental, and vision benefits
- 11 paid holidays
- Disability and basic life insurance
- Family-forming assistance
- A mental health program
- For salaried roles: flexible paid time off/vacation, plus 80 hours of paid sick time per year
- Premium healthcare
- Wellness expense reimbursement
Company Overview
Company H1B Sponsorship