Lead Data Protection Engineer: Key Management, Hybrid, RSUs

DocuSign, Inc.; Seattle (WA); Hybrid; USD 179,000 - 263,000; Full time

Benefits offered by this job

Paid Time Off

Paid Parental Leave

Full Health Benefits Plans

Retirement Plans

Learning and Development

Compassionate Care Leave

Job summary

DocuSign, Inc. seeks a Lead Software Engineer for the Data Protection team to architect and implement a cryptographic key management platform across our global infrastructure. You will own systems enabling customers to control encryption keys, drive cryptographic controls, and advance data protection across services.

This hands-on role reports to the Sr. Manager, Software Engineering and emphasizes secure, well-tested code, threat modeling, and collaboration with cross-functional teams to meet

Qualifications

• 12+ years of hands-on development experience in C# or other object-oriented languages.
• 12+ years of software engineering experience in high-scale distributed systems.
• Experience with cloud Key Management Services (KMS) AWS KMS, Azure Key Vault, GCP Cloud KMS, or equivalent - including key lifecycle management (rotation, revocation, expiry) and cross-tenant or cross-account key access patterns
• Experience with encryption fundamentals key wrapping (DEK/KEK model), asymmetric key operations, and cryptographic key lifecycle management
• B.S. or M.S. in Computer Science or equivalent experience

Responsibilities

• Design and build cryptographic key management systems that support the full key lifecycle generation, distribution, rotation, revocation, and expiry across cloud environments at enterprise scale
• Build and maintain operational tooling for the health, observability, and reliability of cryptographic services and key integrations
• Drive adoption of encryption best practices across Docusign's platform, establishing and evolving standards for data-at-rest and data-in-transit protection
• Collaborate with engineering teams across the company to ensure their systems correctly support data protection requirements - advising on encryption patterns, key management constraints, and data isolation boundaries
• Contribute to threat modeling and security design reviews for new platform initiatives, identifying cryptographic and data protection risks early in the development lifecycle
• Develop high-quality, ship-ready code covered by a full test suite
• Conduct design and code reviews with a focus on security and availability not just coding to a spec

Skills

C#

Distributed systems

Key management

Encryption basics

cryptographic lifecycle

Education

B.S. or M.S. in Computer Science

Tools

AWS KMS

Azure Key Vault

GCP Cloud KMS

Job description

DocuSign, Inc. seeks a Lead Software Engineer for the Data Protection team to architect and implement a cryptographic key management platform across our global infrastructure. You will own systems enabling customers to control encryption keys, drive cryptographic controls, and advance data protection across services.

This hands-on role reports to the Sr. Manager, Software Engineering and emphasizes secure, well-tested code, threat modeling, and collaboration with cross-functional teams to meet