Sr. Detection Engineer
Job Fit Check
Base Career helps you apply smarter for this job.
Key skills for this role
Key Skills for This Role
Full Job Posting
Responsibility
- Onboard and integrate log sources into our SIEM. Work with platform and data owners to identify, scope, and operationalize new telemetry from initial source discovery through parsing, normalization, and validation in production
- Design and implement security data pipelines. Architect end-to-end flows for collecting, transforming, enriching, and routing security telemetry at scale. Make decisions about pipeline topology, buffering, backpressure, and delivery guarantees
- Transform and enrich data in-flight. Use data engine tooling to filter noise, normalize schemas, enrich events with contextual data (asset metadata, threat intel, identity), and route logs to their correct destination - whether that's the SIEM or a data lake
- Own infrastructure-as-code and CI/CD. Manage cloud resources via Terraform. Build and maintain CI/CD pipelines that deploy pipeline configurations, detection content, and infrastructure changes through proper git flow with review, testing, and automated rollback
- Build automation and tooling. Develop software (Python primarily) to automate repetitive security operations workflows log source onboarding, health checks, data validation, alerting integrations, and operational runbooks
- Implement pipeline reliability and observability. Design and maintain monitoring that alerts on logging disruptions, ingestion latency, volume anomalies, parsing failures, and data quality degradation. Establish SLOs for data freshness, completeness, and correctness. Ensure the team knows when data stops flowing before the adversary takes advantage of it
- Collaborate with Detection Engineers to ensure they have the data they need, in the schema they expect, with the freshness guarantees their detections require
- Contribute to operational excellence. Document pipeline architecture, runbooks, and onboarding processes. Participate in on-call rotation for data platform issues
- Embrace and implement Detection-as-Code principles throughout the detection lifecycle. This includes using version control, automated testing, and continuous integration/continuous deployment (CI/CD) pipelines for detections to ensure consistency, reliability, and scalability
- Design, develop, and implement high-fidelity threat detections based on threat intelligence, attacker TTPs, and analysis of security telemetry. Focus on creating detections that are effective, accurate, and minimize false positives
- Communicate technical concepts. Clearly and concisely communicate technical security concepts, findings, and recommendations to both technical and non-technical stakeholders
- Hybrid: Employee divides their time between in-office and remote work. Access to an office location is required. (Frequency: Minimum 2 days per week; may vary by team but will be weekly in-office expectation)
- Positions at Docusign are assigned a job designation of either In Office, Hybrid or Remote and are specific to the role/job. Preferred job designations are not guaranteed when changing positions within Docusign. Docusign reserves the right to change a position's job designation depending on business needs and as permitted by local law.
Basic
8+ years in cybersecurity, SRE, data engineering, or a related field, with at least 2 years focused on security data pipelines or SIEM platform engineering
Hands-on experience onboarding log sources into a SIEM (e.g., Microsoft Sentinel, Splunk, Elastic) - including working with platform/data owners, configuring collection agents/connectors, writing parsers, and validating data in production
Experience designing and operating security data pipelines - including architecture decisions around ingestion, buffering, transformation, routing, and storage
Experience with data engine/stream processing tooling for filtering, normalizing, enriching, and routing logs (e.g., Cribl, Logstash, Azure Data Explorer, custom ETL)
Experience with Infrastructure-as-Code - Terraform for managing cloud resources (Azure preferred; AWS or GCP transferable), with real experience managing state, modules, and drift
Experience with DevOps fundamentals - git flow, pull request workflows, CI/CD pipelines (e.g., GitHub Actions, Azure DevOps), automated testing and deployment of infrastructure and pipeline configurations
Experience in software development with Python or Go - not just scripting, but writing maintainable, testable code for automation, tooling, and integrations
Experience implementing observability and reliability checks for data pipelines - monitoring for ingestion failures, latency spikes, volume drops, schema drift, and data quality issues
Experience with cloud-native logging and monitoring services (e.g., Azure Monitor, Event Hubs, Log Analytics workspaces)
Experience with security log types and their value network, endpoint, identity, cloud audit, application even if you haven't written detections against them
Experience querying and analyzing logs in a SIEM (e.g., KQL, SPL) - for validating data onboarding, troubleshooting pipeline issues, and verifying data quality and completeness
Preferred
Familiarity with Detection-as-Code practices and how pipeline changes impact downstream detection logic
Experience with data engine platforms to perform log filtering, normalization, enrichment, and routing
Background in SRE or platform engineering with an interest in security
Exposure to the MITRE ATT&CK framework and how data source coverage maps to detection coverage
Bachelor's degree or equivalent experience in Computer Science, Engineering, or a related field
Working here
Docusign is committed to building trust and making the world more agreeable for our employees, customers and the communities in which we live and work. You can count on us to listen, be honest, and try our best to do what’s right, every day. At Docusign, everything is equal.
We each have a responsibility to ensure every team member has an equal opportunity to succeed, to be heard, to exchange ideas openly, to build lasting relationships, and to do the work of their life. Best of all, you will be able to feel deep pride in the work you do, because your contribution helps us make the world better than we found it. And for that, you’ll be loved by us, our customers, and the world in which we live.
Accommodation
Docusign is committed to providing reasonable accommodations for qualified individuals with disabilities in our job application procedures. If you need such an accommodation, or a religious accommodation, during the application process, please contact us at accommodations@docusign.com .
If you experience any issues, concerns, or technical difficulties during the application process please get in touch with our Talent organization at taops@docusign.com for assistance.
Applicant and Candidate Privacy Notice
About DocuSign
DocuSign provides intelligent agreement management and e-signature software solutions.
Visit company websiteJobs and hiring trendsApply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer
More jobs at DocuSign
Recruiter
Sydney, AUS
Recruiting Coordinator
Bengaluru, IND
Software Engineer
San Francisco, USA
Prospecting Science Innovation Adoption Specialist
Seattle, USA
Lead Product Manager - Commerce Applications
San Francisco, USA
Lead Product Designer - Admin Team
Seattle, USA
Senior Customer Success Account Manager
, USA
Tax Analyst
, USA