Threat Intelligence Engineer

DocuSign, Inc.; United States; Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Hybrid work arrangement

Job summary

DocuSign, Inc. is seeking a threat-intelligence engineering contributor to build the infrastructure for collecting, processing, and analyzing security data at scale.

You will work with intelligence analysts to deliver tools, workflows, dashboards, and data services that empower operations. The role combines data engineering, security automation, and platform integration, with emphasis on reliability, observability, and actionable insights.

Qualifications

• 3+ years of experience in threat-intelligence engineering, incident response, security automation, or data engineering.
• Experience using generative AI in security operations, including prompt design, model benchmarking, and integration into intelligence workflows.
• Experience deploying and maintaining threat-intelligence platforms and integrating structured threat data.

Responsibilities

• Architect, build, and maintain infrastructure for collecting, processing, storing, and analyzing cyber-threat-intelligence data.
• Create scalable automations, data pipelines, integrations, and centralized access patterns for intelligence operations.
• Apply engineering practices that improve data quality, reliability, observability, and operational awareness.
• Partner with analysts to translate operational needs into high-performing technical solutions.
• Configure and maintain threat-intelligence platforms and connect structured threat data to enterprise security tools.
• Produce technical documentation, interactive dashboards, and metrics that show system performance and business impact.

Skills

Threat intelligence

Security automation

Data engineering

Python notebooks

Education

Bachelor's or master's in CS/Cybersecurity

Tools

Python

SQL

AWS/Azure/GCP

Job description

Role overview

Build the engineering foundation that enables a threat-intelligence function to collect, process, analyze, and disseminate security information at scale. This individual-contributor role combines data engineering, security automation, infrastructure, platform integration, and operational visibility. You will work closely with intelligence analysts to turn requirements into dependable tools, workflows, dashboards, and data services.

Responsibilities

• Architect, build, and maintain infrastructure for collecting, processing, storing, and analyzing cyber-threat-intelligence data.
• Create scalable automations, data pipelines, integrations, and centralized access patterns for intelligence operations.
• Apply engineering practices that improve data quality, reliability, observability, and operational awareness.
• Partner with analysts to translate operational needs into high-performing technical solutions.
• Configure and maintain threat-intelligence platforms and connect structured threat data to enterprise security tools.
• Produce technical documentation, interactive dashboards, and metrics that show system performance and business impact.

Requirements

• At least 3 years of experience in threat-intelligence engineering, incident response, security automation, or data engineering.
• Hands-on experience using generative AI in security operations, including prompt design, model benchmarking, and integration into intelligence workflows.
• Experience deploying and maintaining threat-intelligence platforms and integrating structured threat data.
• Proficiency creating and managing interactive Python notebooks, configuring data connections, building reusable workflows, and documenting analysis.
• Bachelor's or master's degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
• Strong written and verbal communication skills for explaining complex technical concepts.

Nice to have

• Experience with cloud data platforms, automation services, and infrastructure as code in AWS, Azure, or GCP.
• Git-based development practices including pull requests, code review, CI/CD, and automated testing.
• Integrations with SIEM, SOAR, EDR/XDR, vulnerability-management, or case-management systems.
• Familiarity with STIX/TAXII, MITRE ATT&CK, Python, SQL, APIs, and relational, graph, or search databases.

Benefits and work setup

• Hybrid position requiring access to an office and typically at least two in-office days per week; frequency may vary by team.