Security Platform Engineer

Company OverviewDocusign brings agreements to life. Over 1.5 million customers and more than a billion people in over 180 countries use Docusign solutions to accelerate the process of doing business and simplify people’s lives. With intelligent agreement management, Docusign unleashes business-critical data that is trapped inside of documents. Until now, these were disconnected from business systems of record, costing businesses time, money, and opportunity. Using Docusign’s Intelligent Agreement Management platform, companies can create, commit, and manage agreements with solutions created by the #1 company in e-signature and contract lifecycle management (CLM).What you'll doDocusign Security Operations, comprising Threat Intel, Detection Engineering, and CSIRT, identifies and mitigates threats through detection building, alert analysis, and forensic investigations. We are proactive intent-driven problem-solvers dedicated to securing the business. At Docusign, we prioritize trust, safeguarding customer data, and platform integrity. Our dynamic and global team innovates at speed with cutting-edge tech, fostering continuous improvement and proactive defense against evolving threats.Detection Engineering owns the security data platform that powers our detection operations, enabling the identification of threats and delivering actionable alerts to our CSIRT for effective response.Docusign is seeking a skilled and motivated Senior Security Platform Engineer to join our Detection Engineering team. Reporting to the Manager of Detection Engineering, you will play a central role in building and operating the security data pipeline that underpins our detection and response capabilities. This role is focused on onboarding log sources to our SIEM, designing and building security data pipelines, and ensuring the reliability and quality of the telemetry that we collect.You will own cloud infrastructure through Terraform across multiple Azure tenants, build and maintain CI/CD pipelines in Azure DevOps, and develop automated security operations workflows. We are looking for someone with the engineering depth to ensure the right data arrives in the right place, in the right shape, on time. This role requires a strong technical foundation in data engineering or DevOps, an SRE-minded approach to reliability, the ability to be on-call, and a passion for building and maintaining the critical infrastructure that powers our detection efforts.We strongly encourage applications from software engineers, data engineers, and site reliability engineers who have security experience or a demonstrated interest in security. If you've built reliable data pipelines, written production automation, or managed cloud infrastructure and you're motivated by the problem of keeping an organization's security telemetry complete, fresh, and trustworthy this role is for you.This position is an individual contributor role reporting to the Sr. Manager, Threat Detection Engineering.ResponsibilityOnboard and integrate log sources into our SIEM and work with platform and data owners to identify, scope, and operationalize new telemetry — from initial source discovery through parsing, normalization, and validation in productionDesign and implement security data pipelinesArchitect end-to-end flows for collecting, transforming, enriching, and routing security telemetry at scale and make decisions about pipeline topology, buffering, backpressure, and delivery guaranteesTransform and enrich data in-flight, using data engine tooling to filter noise, normalize schemas, enrich events with contextual data (asset metadata, threat intel, identity), and route logs to their correct destination — whether that's the SIEM or a data lakeOwn infrastructure-as-code and CI/CD and manage cloud resources via Terraform across multiple Azure AD tenants and subscriptionsBuild and maintain CI/CD pipelines that deploy infrastructure changes, pipeline configurations, and data onboarding through version-controlled git workflows with code review, automated testing, and repeatable deploymentsBuild automation and tooling and develop software (Python primarily) to automate repetitive security operations workflows — log source onboarding, health checks, data validation, alerting integrations, and operational runbooksImplement pipeline reliability and observability and design and maintain monitoring that alerts on logging disruptions, ingestion latency, volume anomalies, parsing failures, and data quality degradationEstablish SLOs for data freshness, completeness, and correctness, ensuring the team knows when data stops flowing before the adversary takes advantage of itSupport Detection Engineers by ensuring the data platform delivers the telemetry their detections require, in the schema they expect, with the freshness guarantees their detection logic depends onContribute to operational excellence, document pipeline architecture, runbooks, and onboarding processes, and participate in on-call rotation for data platform issuesClearly and concisely communicate technical security concepts, findings, and recommendations to both technical and non-technical stakeholdersJob DesignationHybrid: Employee divides their time between in-office and remote work. Access to an office location is required. (Frequency: Minimum 2 days per week; may vary by team but will be weekly in-office expectation)Positions at Docusign are assigned a job designation of either In Office, Hybrid or Remote and are specific to the role/job. Preferred job designations are not guaranteed when changing positions within Docusign. Docusign reserves the right to change a position's job designation depending on business needs and as permitted by local law.What you bringBasic5+ years in cybersecurity, SRE, data engineering, or a related field, with at least 2 years focused on security data pipelines or SIEM platform engineeringInfrastructure-as-Code skills — Terraform for managing cloud resources across multiple Azure tenants and subscriptions, with real experience managing state, writing reusable modules, handling drift, and working in brownfield environments. AWS or GCP experience is transferableHands-on experience onboarding log sources into a SIEM (e.g., Microsoft Sentinel, Splunk, Elastic) — including working with platform/data owners, configuring collection agents/connectors, writing parsers, and validating data in productionExperience designing and operating security data pipelines — including architecture decisions around ingestion, buffering, transformation, routing, and storageProficiency with data engine/stream processing tooling for filtering, normalizing, enriching, and routing logs (e.g., Cribl, Logstash, Azure Data Explorer, custom ETL)DevOps fundamentals — GitHub-based PR workflows, CI/CD pipelines (Azure DevOps preferred; GitHub Actions transferable), automated testing and deployment of infrastructure and pipeline configurationsSoftware development ability in Python (preferred) or Go — not just scripting, but writing maintainable, testable code for automation, tooling, and integrationsExperience implementing observability and reliability checks for data pipelines — monitoring for ingestion failures, latency spikes, volume drops, schema drift, and data quality issuesFamiliarity with cloud-native logging and monitoring services (e.g., Azure Monitor, Event Hubs, Log Analytics workspaces)Understanding of security log types and their value — network, endpoint, identity, cloud audit, application — even if you haven't written detections against themPreferredExperience managing infrastructure across multiple Azure AD tenants and subscriptionsBackground in SRE or platform engineering with an interest in securityExperience querying and analyzing logs in a SIEM (e.g., KQL, SPL) — for validating data onboarding, troubleshooting pipeline issues, and verifying data quality and completenessExposure to the MITRE ATT&CK framework and how data source coverage maps to detection coverageBachelor's degree or equivalent experience in Computer Science, Engineering, or a related fieldWage TransparencyPay for this position is based on a number of factors including geographic location and may vary depending on job-related knowledge, skills, and experience.Based on applicable legislation, the below details pay ranges in the following locations:California: $147,700.00 - $237,575.00 base salaryThis role is also eligible for the following:Bonus: Sales personnel are eligible for variable incentive pay dependent on their achievement of pre-established sales goals. Non-Sales roles are eligible for a company bonus plan, which is calculated as a percentage of eligible wages and dependent on company performance.Global benefits provide options for the following:Paid Time Off: earned time off, as well as paid company holidays based on regionPaid Parental Leave: take up to six months off with your child after birth, adoption or foster care placementFull Health Benefits Plans: options for 100% employer paid and minimum employee contribution health plans from day one of employmentRetirement Plans: select retirement and pension programs with potential for employer contributionsLearning and Development: options for coaching, online courses and education reimbursementsCompassionate Care Leave: paid time off following the loss of a loved one and other life-changing eventsWork Authorization Notice: Please note that we do not provide visa sponsorship or immigration support for this position. Applicants must already be authorized to work in the United States on a full-time, permanent basis without the need for current or future sponsorship.Life at DocuSignWorking hereDocusign is committed to building trust and making the world more agreeable for our employees, customers and the communities in which we live and work. You can count on us to listen, be honest, and try our best to do what’s right, every day. At Docusign, everything is equal.We each have a responsibility to ensure every team member has an equal opportunity to succeed, to be heard, to exchange ideas openly, to build lasting relationships, and to do the work of their life. Best of all, you will be able to feel deep pride in the work you do, because your contribution helps us make the world better than we found it. And for that, you’ll be loved by us, our customers, and the world in which we live.AccommodationDocusign is committed to providing reasonable accommodations for qualified individuals with disabilities in our job application procedures. If you need such an accommodation, or a religious accommodation, during the application process, please contact us at View email address on click.appcast.io you experience any issues, concerns, or technical difficulties during the application process please get in touch with our Talent organization at View email address on click.appcast.io for assistance.Applicant and Candidate Privacy NoticeStates Not Eligible for EmploymentThis position is not eligible for employment in the following states: Alaska, Hawaii, Maine, Mississippi, North Dakota, South Dakota, Vermont, West Virginia and Wyoming.EEO StatementIt's important to us that we build a talented team that is as diverse as our customers and where all employees feel a deep sense of belonging and thrive. We encourage great talent who bring a range of perspectives to apply for our open positions. Docusign is an Equal Opportunity Employer and makes hiring decisions based on experience, skill, aptitude and a can-do approach. We will not discriminate based on race, ethnicity, color, age, sex, religion, national origin, ancestry, pregnancy, sexual orientation, gender identity, gender expression, genetic information, physical or mental disability, registered domestic partner status, caregiver status, marital status, veteran or military status, or any other legally protected category.EEO Know Your Rights posterJob SummaryLocation: US-CA-San FranciscoCategory: SecurityPosition Type: Regular