[Remote] Senior Security Data Engineer

Note: The job is a remote job and is open to candidates in USA. DoorDash is a technology and logistics company operating a delivery marketplace supported by a global cyber defense team. The Senior Security Data Engineer will own high-volume security telemetry pipelines across AWS and GCP, including data modeling, cost and query optimization, reliability, infrastructure as code, and CI/CD. The role also involves building automation and AI agents, enforcing cloud workload governance, leading cross-functional projects, participating in on-call rotation, and mentoring engineers.

Responsibilities

• Own multi-terabyte-per-day log pipelines across AWS and GCP: ingest, routing, enrichment, schema management, and onboarding new sources as the business adds them
• Control ingest cost and volume, cutting noise at the edge without dropping the audit logs investigators depend on
• Model security data and tune query performance in Snowflake, BigQuery, and Redshift, including the tables detection engineering builds on
• Ship production services and integrations that other teams depend on: custom SIEM connectors, API clients, and automation
• Set and defend SLOs for log availability and freshness, and build the dashboards and alerting that prove them
• Own infrastructure as code and CI/CD for all of the above, including the deployment path that detections-as-code rides on
• Build AI agents and automated runbooks that speed up triage and time to fix across cloud infrastructure
• Enforce IAM and service account governance for the pipeline's cloud workloads
• Lead cross-functional projects spanning infrastructure, platform engineering, and incident response
• Create and maintain the standards and documentation that keep the service consistent, and mentor engineers across Cyber Defense

Skills

• 5+ years building and operating high-volume data pipelines in production at multi-terabyte-per-day scale, with tools like Kafka, Cribl, Dataflow, Kinesis, or CloudWatch
• 4+ years writing production software in Python, Go, Rust, or Java: services and tooling that other engineers run, beyond one-off scripts
• Deep hands-on experience with AWS and GCP, including infrastructure as code and ownership of CI/CD pipelines on GitHub, GitLab, or Bitbucket
• Strong SQL and data modeling in a columnar warehouse such as Snowflake, BigQuery, or Redshift, covering partitioning, cost control, and query tuning
• A track record owning reliability for a platform other engineers depend on, including on-call
• Experience building executive dashboards and engineering metrics that people actually act on
• Proven leadership and technical project management across infrastructure, platform engineering, and incident response
• Exceptional written and verbal communication, a collaborative instinct, and a habit of continuous learning
• Familiarity with an enterprise SIEM as an operator or a consumer (Google SecOps/Chronicle, Splunk, Elastic, CrowdStrike LogScale)
• Time with Kubernetes, Docker, and runtime security controls
• Any hands-on time with security telemetry sources, detections-as-code (YARA-L, Sigma, SPL), LLM-assisted workflows, penetration testing, red teaming, or triaging bug bounty reports

Benefits

• Opportunities for equity grants
• A 401(k) plan with employer matching
• 16 weeks of paid parental leave
• Wellness benefits
• Commuter benefits match
• Paid time off
• Paid sick leave in compliance with applicable laws (e.g. Colorado Healthy Families and Workplaces Act)
• Medical, dental, and vision benefits
• 11 paid holidays
• Disability and basic life insurance
• Family-forming assistance
• A mental health program
• For salaried roles: flexible paid time off/vacation, plus 80 hours of paid sick time per year
• Premium healthcare
• Wellness expense reimbursement

Company Overview

Company H1B Sponsorship