Senior Security Engineer, Proactive Security - Platform

DoorDash USA

1d•$159,800 - $235,000•Remote

About The Position

DoorDash’s Proactive Security Engineering team is hiring a Senior Security Engineer to build and operate the secure, reusable pathways that engineers across DoorDash, Wolt, and Deliveroo use to access infrastructure, manage secrets, and authenticate services. The role is part of the global Security Engineering Platform team, which operates tier-0 security services for access management, secret storage, and identity, including DoorDash’s in-house Access Platform, Teleport, and HashiCorp Vault. The goal is to make secure workflows self-service, well documented, resilient, and integrated into the tools engineers already use. This US-remote role reports directly to the Manager of the Proactive Security Engineering Platform team. The engineer will design and harden pathways for privileged access, secrets management, and identity; assess and test security services and integrations; and build tooling that enables teams to adopt just-in-time access, short-lived credentials, and dynamic secrets. The role also supports migrations away from long-lived credentials and standing access, integrations across Kubernetes, CI/CD, AWS, and GCP, and secure adoption of AI tools and agentic workflows. It includes participation in a follow-the-sun on-call rotation for tier-0 services and operational excellence work such as monitoring, runbooks, incident response, and root cause analysis.

Requirements

At least 6 years of experience as a Security, Infrastructure, or Platform Engineer at an internet-scale organization.
Bachelor’s degree in Computer Science, Security Engineering, or a related field, or equivalent work experience.
Strong software engineering skills in one or more object-oriented languages, such as Go, Java, or Kotlin, including experience building security tooling, controls, and production services that meet business and regulatory requirements.
Hands-on experience with access management and secret storage systems, such as privileged access management, secrets management, or key management platforms.
Working knowledge of identity and authentication standards such as OIDC, SAML, mTLS, and workload identity, including SPIFFE, AWS IAM Roles, or GCP Workload Identity.
Working knowledge of distributed systems concepts, including replication, consistency, and distributed consensus such as Raft or Paxos.
Experience with Kubernetes, Terraform or other infrastructure as code, and AWS and/or GCP IAM.
Experience with threat modeling and security design reviews, and hands-on experience performing root cause analysis for security incidents.
Experience running highly available services with mature on-call practices.
Strong problem-solving skills for complex, systemic issues and clear verbal and written communication skills for working across engineering teams.

Nice To Haves

Experience with Teleport or HashiCorp Vault.

Responsibilities

Design, build, and harden paved paths for privileged access, secrets management, and identity on access management and secret storage platforms.
Threat model, conduct security reviews, and test tier-0 security services and their integrations; drive findings through remediation.
Build self-service tooling, SDKs, Terraform modules, and integrations that enable just-in-time access, short-lived credentials, and dynamic secrets without requiring tickets.
Help migrate systems away from long-lived credentials and standing access, with success measured by classes of exposure eliminated at the platform layer.
Partner with Core Infrastructure, Compute, Data, and product engineering teams to integrate paved paths into Kubernetes, CI/CD, and AWS and GCP environments across DoorDash, Wolt, and Deliveroo.
Participate in a follow-the-sun on-call rotation for tier-0 security services.
Improve operational excellence through monitoring, runbooks, incident response, and root cause analysis.
Enable secure adoption of AI tooling and agentic workflows through access control and secrets brokering for agents.