Detection Engineer

Company Overview Docusign brings agreements to life. Over 1.5 million customers and more than a billion people in over 180 countries use Docusign solutions to accelerate the process of doing business and simplify people’s lives. With intelligent agreement management, Docusign unleashes business-critical data that is trapped inside of documents. Until now, these were disconnected from business systems of record, costing businesses time, money, and opportunity.

Using Docusign’s Intelligent Agreement Management platform, companies can create, commit, and manage agreements with solutions created by the #1 company in e-signature and contract lifecycle management (CLM).What you'll do Detection Engineering is part of Docusign's Security Operations organization, alongside Threat Intelligence and Incident Response (CSIRT). We own the security data platform that powers our detection operations — from data ingestion and pipeline health to the detections and alerts that drive incident response.

We are a global, engineering-driven team that builds at speed and is focused on staying ahead of evolving threats to protect our customers and platform.

We are looking for a Detection Engineer to join our global Detection & Response team. Based in the United States and reporting to the Manager of Detection Engineering, you will translate threat intelligence on adversary tradecraft into behavior-based detections, build and maintain the security data pipeline that powers our detection operations, and manage our SIEM platform using Infrastructure-as-Code. This role spans our cloud, on-premise, and endpoint environments and requires a strong software engineering foundation, a Detection-as-Code mindset, familiarity with using AI to support and streamline Detection Engineering operations, and the ability to be on-call.

Responsibility Design, develop, and deploy high-fidelity, behavior-based threat detections grounded in threat intelligence, attacker TTPs, and security telemetry — with an emphasis on accuracy and minimizing false positives

Own and support the security data pipeline and SIEM platform, including data collection, ingestion, processing, and storage of security telemetry. Monitor for health and data quality issues

Manage and evolve SIEM platform configuration using Infrastructure-as-Code (e.g., Terraform), optimizing for performance, scalability, and reliability

Apply Detection-as-Code principles throughout the detection lifecycle: version control, automated testing, and CI/CD pipelines for detection deployment

Collaborate with Incident Response to translate threat intelligence into actionable detections with automated response workflows, and participate in post-incident reviews to improve detection coverage

Integrate AI into Detection Engineering workflows to accelerate detection development, improve signal quality, and scale operations

Partner with engineering, product, and security teams to ensure comprehensive coverage, address blind spots, and embed security monitoring into the software development lifecycle

Contribute to establishing repeatable, scalable processes and track metrics to measure the effectiveness of detection capabilities

Communicate technical security concepts, findings, and recommendations clearly to both technical and non-technical stakeholders

Job Designation Hybrid:
Employee divides their time between in-office and remote work. Access to an office location is required. (Frequency: Minimum 2 days per week; may vary by team but will be weekly in-office expectation)
Positions at Docusign are assigned a job designation of either In Office, Hybrid or Remote and are specific to the role/job. Preferred job designations are not guaranteed when changing positions within Docusign. Docusign…