Security Engineer, Insider Threat

DoorDash is a technology and logistics company focused on building a scalable and reliable delivery network. The Security Engineer, Insider Threat role involves conducting investigations into potential risks, analyzing threat intelligence, and developing detection capabilities to ensure a secure environment.

Responsibilities:

• Use monitoring and detection platforms to investigate anomalous activity for potential insider risk, and develop detections to proactively identify similar behaviors at scale
• Support the onboarding, implementation, and improvement of custom tooling designed to alert on anomalous behaviors
• Create and maintain a use case library to inform detections, and develop corresponding playbooks, leveraging version-controlled workflows (e.g., Git) to ensure consistency and scalability
• Create standard operating procedures and cross-functional processes to govern investigation and response collaboration between teams
• Leverage and help develop agentic and AII-assisted workflows to automate and scale insider threat investigations and detection capabilities
• Prepare investigative reports and briefings for leadership
• Maintain chain-of-evidence and engage with External Law Enforcement, when required
• Lead training or other education and awareness opportunities for the enterprise as required

Requirements:

• 2-5+ years of experience in insider threat investigations, incident response, or federal law enforcement
• Strong verbal and written communication skills with experience presenting findings to stakeholders
• Experience conducting ethical, complex investigations in partnership with Legal, HR, and cross-functional stakeholders
• Hands-on experience with insider risk and security tooling including SIEM/SOAR platforms, UEBA, UAM, and DLP tools
• Proficiency querying large-scale datasets to support investigations (e.g. SQL) and familiarity with log sources, data pipelines, and parsing
• Familiarity with scripting and automation, and experience working in cloud and distributed environments using version control