Detection Engineer

Docusign • San Francisco, CA

6d • Hybrid

About The Position

Detection Engineering is part of Docusign's Security Operations organization, alongside Threat Intelligence and Incident Response (CSIRT). We own the security data platform that powers our detection operations — from data ingestion and pipeline health to the detections and alerts that drive incident response. We are a global, engineering-driven team that builds at speed and is focused on staying ahead of evolving threats to protect our customers and platform.
We are looking for a Detection Engineer to join our global Detection & Response team. Based in the United States and reporting to the Manager of Detection Engineering, you will translate threat intelligence on adversary tradecraft into behavior-based detections, build and maintain the security data pipeline that powers our detection operations, and manage our SIEM platform using Infrastructure-as-Code. This role spans our cloud, on-premise, and endpoint environments and requires a strong software engineering foundation, a Detection-as-Code mindset, familiarity with using AI to support and streamline Detection Engineering operations, and the ability to be on-call.

Requirements

• 4+ years in cybersecurity, with at least 2+ years in a dedicated threat detection engineering role
• The individual must be a U.S. Citizen, U.S. National or U.S. Person Individuals outside of these categories are generally barred from having logical access to IL5 data or infrastructure
• Hands-on experience building and supporting security data pipelines and SIEM platforms, including configuration via Infrastructure-as-Code (e.g., Terraform)
• Experience filtering, normalizing, and enriching security events pre-ingestion using data pipeline engines (e.g., Cribl)
• Experience developing threat detections at scale across cloud environments (AWS, Azure, GCP), using detection rule languages such as SPL or KQL

Nice To Haves

• Bachelor's degree or equivalent experience in Computer Science, Cybersecurity, or a related field; advanced degree or security certifications (e.g., GIAC, CISSP)
• Experience with anomaly detection, machine learning, or statistical analysis of user behavior for security purposes
• Background in offensive security or security-focused software engineering
• History of speaking at security conferences or publishing security research
• Deep understanding of the cyber threat landscape, attacker TTPs, and frameworks such as MITRE ATT&CK
• Proficiency with security tooling: SIEM/SOAR platforms, EDR, and cloud-native security solutions
• Strong scripting and programming skills (e.g., Python, Go, Bash, PowerShell) for security tooling, automation, and API integrations
• Proficiency with CI/CD pipelines and Detection-as-Code practices
• Familiarity with using AI to support and streamline Detection Engineering operations
• Strong analytical and problem-solving skills with attention to detail

Responsibilities

• Design, develop, and deploy high-fidelity, behavior-based threat detections grounded in threat intelligence, attacker TTPs, and security telemetry — with an emphasis on accuracy and minimizing false positives
• Own and support the security data pipeline and SIEM platform, including data collection, ingestion, processing, and storage of security telemetry. Monitor for health and data quality issues
• Manage and evolve SIEM platform configuration using Infrastructure-as-Code (e.g., Terraform), optimizing for performance, scalability, and reliability
• Apply Detection-as-Code principles throughout the detection lifecycle: version control, automated testing, and CI/CD pipelines for detection deployment
• Collaborate with Incident Response to translate threat intelligence into actionable detections with automated response workflows, and participate in post-incident reviews to improve detection coverage
• Integrate AI into Detection Engineering workflows to accelerate detection development, improve signal quality, and scale operations
• Partner with engineering, product, and security teams to ensure comprehensive coverage, address blind spots, and embed security monitoring into the software development lifecycle
• Contribute to establishing repeatable, scalable processes and track metrics to measure the effectiveness of detection capabilities
• Communicate technical security concepts, findings, and recommendations clearly to both technical and non-technical stakeholders

Benefits

• Bonus: Sales personnel are eligible for variable incentive pay dependent on their achievement of pre-established sales goals. Non-Sales roles are eligible for a company bonus plan, which is calculated as a percentage of eligible wages and dependent on company performance.
• Paid Time Off: earned time off, as well as paid company holidays based on region
• Paid Parental Leave: take up to six months off with your child after birth, adoption or foster care placement
• Full Health Benefits Plans: options for 100% employer paid and minimum employee contribution health plans from day one of employment
• Retirement Plans: select retirement and pension programs with potential for employer contributions
• Learning and Development: options for coaching, online courses and education reimbursements
• Compassionate Care Leave: paid time off following the loss of a loved one and other life-changing events

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: Associate degree