AI-Driven Incident Response Lead (Hybrid)

DocuSign; Seattle (WA); Hybrid; USD 140,000 - 207,000; Full time

Job summary

DocuSign is seeking a seasoned CSIRT Investigator in the United States to lead incident response activities and improve detection capabilities. The role requires heavy experience with SIEM/EDR, digital forensics, and scripting for automation, with hybrid in-office expectations and security-focused collaboration across teams.

You will participate in on-call rotations, investigate complex incidents, and contribute to post-incident analyses while staying current on threat intelligence and emerging

Qualifications

• 8+ years in cybersecurity focused on SOC/IR.
• Must be a U.S. citizen/national/person.
• Experience leading incident responses.
• Experience with crisis management.
• Experience with SIEM (Splunk/QRadar/Sentinel) for alert analysis & log correlation.
• Experience with EDR and incident investigation.
• Experience with digital forensics principles and enterprise tools.
• Experience with scripting (Python/PowerShell/Bash) for automation.

Responsibilities

• Leverage AI and ML tools to enhance log analysis, alert triage, and threat hunting.
• Monitor for and investigate security incidents involving AI/ML models.
• Collaborate with detection engineering to develop AI-based detection logic to improve SOC visibility.
• Research and adopt emerging AI-driven security technologies to evolve CSIRT's proactive defense capabilities.
• Perform initial triage and in-depth analysis of security alerts generated from our SIEM and other security monitoring tools.
• Correlate events from various log sources to identify potential security incidents.
• Determine the scope, severity, and potential impact of detected threats.
• Conduct technical investigations into cybersecurity incidents, including malware analysis, phishing attacks, web app compromises, and insider threats.
• Utilize digital forensics techniques on data and endpoints to gather evidence and understand incident timelines and methods.
• Support incident containment, eradication, and recovery efforts under the CSIRT Manager guidance.
• Document incident findings, actions taken, and lessons learned.
• Assist in the development and refinement of threat detection rules to improve SOC visibility.
• Participate in proactive threat hunting activities to uncover hidden threats within the enterprise environment.
• Stay informed about the latest threat intelligence and emerging attack techniques.
• Work with SIEM and SOAR platforms to optimize alert processing and incident workflows.
• Contribute to the creation and refinement of automated solutions for efficient incident response and reporting.
• Identify opportunities for automation to streamline security operations.
• Collaborate with other security teams, IT, and business units during incident response.
• Provide clear and concise updates on incident status to the CSIRT Manager.
• Contribute to post-incident reports and analysis.
• Maintain working relationships with law enforcement when required.

Skills

SOC Operations

Incident Response

Python scripting

EDR experience

Digital Forensics

Log analysis

Threat hunting

Crisis management

AI/ML security

Education

Bachelor's degree in CS/InfoSec

Security certifications (CompTIA Security+, CySA+, GCIH, GCFA, CEH)

Tools

Splunk/QRadar/Sentinel

EDR solutions

Digital forensics tools

Automation tooling

Job description

DocuSign is seeking a seasoned CSIRT Investigator in the United States to lead incident response activities and improve detection capabilities. The role requires heavy experience with SIEM/EDR, digital forensics, and scripting for automation, with hybrid in-office expectations and security-focused collaboration across teams.

You will participate in on-call rotations, investigate complex incidents, and contribute to post-incident analyses while staying current on threat intelligence and emerging