Senior Security Engineer, Proactive Security - Platform

DoorDash USA

2h•$159,800 - $235,000•Remote

About The Position

DoorDash is hiring a Senior Security Engineer for its Proactive Security Engineering Platform team. This US-remote role builds and operates tier-0 security services for access management, secret storage, and identity, including DoorDash’s in-house Access Platform, Teleport, and HashiCorp Vault. The role supports engineers across DoorDash, Wolt, and Deliveroo by making secure practices easy to adopt through self-service tooling, clear documentation, and integrations into everyday engineering tools. The engineer will design and harden secure pathways for privileged access, secrets management, and identity; review and test security services and their integrations; and help teams move away from long-lived credentials and standing access. The work includes partnering with infrastructure and product engineering teams to integrate these capabilities into Kubernetes, CI/CD, AWS, and GCP environments. The role also participates in a follow-the-sun on-call rotation and supports operational excellence for critical services. It reports directly to the Manager of the Proactive Security Engineering Platform team. DoorDash offers compensation including base salary and equity opportunities, along with comprehensive benefits. The position is expected to be filled by 12/30/2026.

Requirements

At least 6 years of experience as a Security, Infrastructure, or Platform Engineer at an internet-scale organization.
Bachelor’s degree in Computer Science, Security Engineering, or a related field, or equivalent work experience.
Strong software engineering skills in one or more object-oriented languages, such as Go, Java, or Kotlin, including experience building security tooling, controls, and production services that meet business and regulatory requirements.
Hands-on experience with access-management and secret-storage systems, such as privileged access management, secrets-management, or key-management platforms.
Working knowledge of identity and authentication standards such as OIDC, SAML, mTLS, and workload identity, including SPIFFE, AWS IAM Roles, or GCP Workload Identity.
Working knowledge of distributed-systems concepts, including replication, consistency, and distributed consensus such as Raft or Paxos.
Experience with Kubernetes, Terraform or other infrastructure-as-code tools, and AWS and/or GCP IAM.
Experience with threat modeling, security design reviews, and hands-on root cause analysis for security incidents.
Experience operating highly available services with mature on-call practices.
Strong problem-solving skills for complex systemic issues and clear verbal and written communication skills for cross-team work.

Nice To Haves

Experience with Teleport or HashiCorp Vault.

Responsibilities

Design, build, and harden paved paths for privileged access, secrets management, and identity using access-management and secret-storage platforms.
Threat model, conduct security reviews, and test tier-0 security services and integrations; drive identified findings through remediation.
Build self-service tooling, SDKs, Terraform modules, and integrations to enable just-in-time access, short-lived credentials, and dynamic secrets without requiring tickets.
Drive migrations away from long-lived credentials and standing access, measuring success by exposure eliminated at the platform layer.
Partner with Core Infrastructure, Compute, Data, and product engineering teams to integrate secure pathways into Kubernetes, CI/CD, AWS, and GCP environments across DoorDash, Wolt, and Deliveroo.
Participate in a follow-the-sun on-call rotation for tier-0 security services and improve operational excellence through monitoring, runbooks, incident response, and root cause analysis.
Enable secure adoption of AI tooling and agentic workflows through access control and secrets brokering for agents.