Sr. Detection Engineer

DocuSign, Inc.; Bengaluru; On-site; INR 3,500,000 - 6,000,000; Full time

Job summary

DocuSign, Inc. is seeking a Senior Detection Engineer to join the Threat Detection Engineering team in a hybrid role based in Bengaluru, India.

You will build and operate the security data pipeline, onboard log sources to SIEM, and ensure telemetry is complete, timely, and trustworthy across scalable data pipelines. You will design end‑to‑end data flows, implement CI/CD for detections, and develop automation in Python to support security operations.

Qualifications

• 8+ years in cybersecurity, SRE, data engineering, or a related field, with at least 2 years focused on security data pipelines or SIEM platform engineering.
• Hands-on experience onboarding log sources into a SIEM (e.g., Microsoft Sentinel, Splunk, Elastic).
• Experience designing and operating security data pipelines – architecture decisions around ingestion, buffering, transformation, routing, and storage.
• Experience with data engine/stream processing tooling for filtering, normalizing, enriching, and routing logs (e.g., Cribl, Logstash, Azure Data Explorer, custom ETL).
• Experience with Infrastructure-as-Code – Terraform for managing cloud resources (Azure preferred; AWS or GCP transferable).
• Experience with DevOps fundamentals – git flow, pull request workflows, CI/CD pipelines, automated testing and deployment of infrastructure and pipeline configurations.
• Experience in software development with Python or Go – not just scripting, but writing maintainable, testable code for automation, tooling, and integrations.
• Experience implementing observability and reliability checks for data pipelines – monitoring for ingestion failures, latency spikes, volume drops, schema drift, and data quality issues.
• Experience with cloud-native logging and monitoring services (e.g., Azure Monitor, Event Hubs, Log Analytics workspaces).
• Experience with security log types and their value network, endpoint, identity, cloud audit, application even if you haven’t written detections against them
• Experience querying and analyzing logs in a SIEM (e.g., KQL, SPL) – for validating data onboarding, troubleshooting pipeline issues, and verifying data quality and completeness.

Responsibilities

• Onboard and integrate log sources into our SIEM. Work with platform and data owners to identify, scope, and operationalize new telemetry from initial source discovery through parsing, normalization, and validation in production.
• Design and implement security data pipelines. Architect end‑to‑end flows for collecting, transforming, enriching, and routing security telemetry at scale.
• Make decisions about pipeline topology, buffering, backpressure, and delivery guarantees.
• Transform and enrich data in‑flight. Use data engine tooling to filter noise, normalize schemas, enrich events with contextual data, and route logs to their correct destination.
• Own infrastructure‑as‑code and CI/CD. Manage cloud resources via Terraform. Build and maintain CI/CD pipelines that deploy pipeline configurations, detection content, and infrastructure changes through proper git flow with review, testing, and automated rollback.
• Build automation and tooling. Develop software (Python primarily) to automate repetitive security operations workflows log source onboarding, health checks, data validation, alerting integrations, and operational runbooks.
• Implement pipeline reliability and observability. Design and maintain monitoring that alerts on logging disruptions, ingestion latency, volume anomalies, parsing failures, and data quality degradation.
• Collaborate with Detection Engineers to ensure they have the data they need, in the schema they expect, with the freshness guarantees their detections require.
• Contribute to operational excellence. Document pipeline architecture, runbooks, and onboarding processes. Participate in on‑call rotation for data platform issues.
• Embrace and implement Detection‑as‑Code principles throughout the detection lifecycle. This includes using version control, automated testing, and CI/CD pipelines for detections to ensure consistency, reliability, and scalability.
• Design, develop, and implement high‑fidelity threat detections based on threat intelligence, attacker TTPs, and analysis of security telemetry.
• Communicate technical concepts clearly to technical and non‑technical stakeholders.

Skills

8+ years in cybersecurity,SRE, dataEng

SIEM onboarding experience

Security data pipelines

Data engine/stream processing

Terraform / IaC

CI/CD pipelines

Python or Go automation

Observability & reliability checks

Cloud-native logging/monitoring

SIEM querying (KQL,SPL)

Education

Bachelor’s degree in CS/Engineering or related

Tools

Terraform

Splunk

Cribl

Logstash

Azure Data Explorer

GitHub Actions

Azure DevOps

Python

Go

KQL

Job description

Company Overview

Docusign brings agreements to life. Over 1.5 million customers and more than a billion people in over 180 countries use Docusign solutions to accelerate the process of doing business and simplify people’s lives. With intelligent agreement management, Docusign unleashes business-critical data that is trapped inside of documents. Until now, these were disconnected from business systems of record, costing businesses time, money, and opportunity. Using Docusign’s Intelligent Agreement Management platform, companies can create, commit, and manage agreements with solutions created by the #1 company in e‑signature and contract lifecycle management (CLM).

What you’ll do

Docusign is seeking a skilled and motivated Senior Detection Engineer to join our Threat Detection Engineering team. Reporting to the Manager of Detection Engineering, you will play a central role in building and operating the security data pipeline that underpins our detection and response capabilities. This role is focused on onboarding log sources to our SIEM, designing and building security data pipelines, and ensuring the reliability and quality of the telemetry that we collect. You will manage cloud infrastructure through Terraform and CI/CD pipelines and build automated security operations workflows. We are looking for someone with the engineering depth to ensure the right data arrives in the right place, in the right shape, on time. This role requires a strong technical foundation in data engineering or DevOps, an SRE‑minded approach to reliability, the ability to be on‑call, and a passion for building and maintaining the critical infrastructure that powers our detection efforts. We strongly encourage applications from software engineers, data engineers, and site reliability engineers who have security experience or a demonstrated interest in security. If you’ve built reliable data pipelines, written production automation, or managed cloud infrastructure and you’re motivated by the problem of keeping an organization’s security telemetry complete, fresh, and trustworthy this role is for you.

This position is an individual contributor role reporting to the Sr. Manager, Threat Detection Engineering.

Responsibilities

• Onboard and integrate log sources into our SIEM. Work with platform and data owners to identify, scope, and operationalize new telemetry from initial source discovery through parsing, normalization, and validation in production

• Design and implement security data pipelines. Architect end‑to‑end flows for collecting, transforming, enriching, and routing security telemetry at scale. Make decisions about pipeline topology, buffering, backpressure, and delivery guarantees

• Transform and enrich data in‑flight. Use data engine tooling to filter noise, normalize schemas, enrich events with contextual data (asset metadata, threat intel, identity), and route logs to their correct destination – whether that’s the SIEM or a data lake

• Own infrastructure‑as‑code and CI/CD. Manage cloud resources via Terraform. Build and maintain CI/CD pipelines that deploy pipeline configurations, detection content, and infrastructure changes through proper git flow with review, testing, and automated rollback

• Build automation and tooling. Develop software (Python primarily) to automate repetitive security operations workflows log source onboarding, health checks, data validation, alerting integrations, and operational runbooks

• Implement pipeline reliability and observability. Design and maintain monitoring that alerts on logging disruptions, ingestion latency, volume anomalies, parsing failures, and data quality degradation. Establish SLOs for data freshness, completeness, and correctness. Ensure the team knows when data stops flowing before the adversary takes advantage of it

• Collaborate with Detection Engineers to ensure they have the data they need, in the schema they expect, with the freshness guarantees their detections require

• Contribute to operational excellence. Document pipeline architecture, runbooks, and onboarding processes. Participate in on‑call rotation for data platform issues

• Embrace and implement Detection‑as‑Code principles throughout the detection lifecycle. This includes using version control, automated testing, and continuous integration/continuous deployment (CI/CD) pipelines for detections to ensure consistency, reliability, and scalability

• Design, develop, and implement high‑fidelity threat detections based on threat intelligence, attacker TTPs, and analysis of security telemetry. Focus on creating detections that are effective, accurate, and minimize false positives

• Communicate technical concepts. Clearly and concisely communicate technical security concepts, findings, and recommendations to both technical and non‑technical stakeholders

Job Designation

Hybrid: Employee divides their time between in‑office and remote work. Access to an office location is required. (Frequency: Minimum 2 days per week; may vary by team but will be weekly in‑office expectation)

Positions at Docusign are assigned a job designation of either In Office, Hybrid or Remote and are specific to the role/job. Preferred job designations are not guaranteed when changing positions within Docusign. Docusign reserves the right to change a position’s job designation depending on business needs and as permitted by local law.

What you bring

Basic

• 8+ years in cybersecurity, SRE, data engineering, or a related field, with at least 2 years focused on security data pipelines or SIEM platform engineering

• Hands‑on experience onboarding log sources into a SIEM (e.g., Microsoft Sentinel, Splunk, Elastic) – including working with platform/data owners, configuring collection agents/connectors, writing parsers, and validating data in production

• Experience designing and operating security data pipelines – including architecture decisions around ingestion, buffering, transformation, routing, and storage

• Experience with data engine/stream processing tooling for filtering, normalizing, enriching, and routing logs (e.g., Cribl, Logstash, Azure Data Explorer, custom ETL)

• Experience with Infrastructure‑as‑Code – Terraform for managing cloud resources (Azure preferred; AWS or GCP transferable), with real experience managing state, modules, and drift

• Experience with DevOps fundamentals – git flow, pull request workflows, CI/CD pipelines (e.g., GitHub Actions, Azure DevOps), automated testing and deployment of infrastructure and pipeline configurations

• Experience in software development with Python or Go – not just scripting, but writing maintainable, testable code for automation, tooling, and integrations

• Experience implementing observability and reliability checks for data pipelines – monitoring for ingestion failures, latency spikes, volume drops, schema drift, and data quality issues

• Experience with cloud‑native logging and monitoring services (e.g., Azure Monitor, Event Hubs, Log Analytics workspaces)

• Experience with security log types and their value network, endpoint, identity, cloud audit, application even if you haven’t written detections against them

• Experience querying and analyzing logs in a SIEM (e.g., KQL, SPL) – for validating data onboarding, troubleshooting pipeline issues, and verifying data quality and completeness

Preferred

• Familiarity with Detection‑as‑Code practices and how pipeline changes impact downstream detection logic

• Experience with data engine platforms to perform log filtering, normalization, enrichment, and routing

• Background in SRE or platform engineering with an interest in security

• Exposure to the MITRE ATT&CK framework and how data source coverage maps to detection coverage

• Bachelor’s degree or equivalent experience in Computer Science, Engineering, or a related field

Accommodation

Docusign is committed to providing reasonable accommodations for qualified individuals with disabilities in our job application procedures. If you need such an accommodation, or a religious accommodation, during the application process, please contact us at [e-mail].