D

Docusign

Runs electronic signing and agreement workflows

Lead Software Engineer - Data Protection

Backend EngineeringConfirmed live in the last 24 hours
Full-timeSeattle, WA, USA

About the Job

Requirements

  • At least 12 years of hands-on development experience in C# or another object-oriented language.
  • At least 12 years of software engineering experience in high-scale distributed systems.
  • Experience with cloud Key Management Services such as AWS KMS, Azure Key Vault, GCP Cloud KMS, or equivalent, including key lifecycle management (rotation, revocation, and expiry) and cross-tenant or cross-account key access patterns.
  • Experience with encryption fundamentals, including key wrapping (DEK/KEK model), asymmetric key operations, and cryptographic key lifecycle management.
  • A B.S. or M.S. in Computer Science, or equivalent experience.

Responsibilities

  • Design and build cryptographic key management systems supporting the full key lifecycle—generation, distribution, rotation, revocation, and expiry—across cloud environments at enterprise scale.
  • Build and maintain operational tooling for the health, observability, and reliability of cryptographic services and key integrations.
  • Drive adoption of encryption best practices across the platform and establish and evolve standards for data-at-rest and data-in-transit protection.
  • Collaborate with engineering teams to ensure their systems support data protection requirements, advising on encryption patterns, key management constraints, and data isolation boundaries.
  • Contribute to threat modeling and security design reviews for new platform initiatives, identifying cryptographic and data protection risks early in the development lifecycle.
  • Develop high-quality, ship-ready code covered by a full test suite.
  • Conduct design and code reviews with a focus on security and availability.

Desired Qualifications

  • Experience with .NET microservice architecture using C# in a high-scale production environment.
  • Hands-on experience with Azure Key Vault RBAC authorization model, Managed Identity integration, Encryption Scopes, and CMK-enabled data services.
  • Experience with cloud infrastructure provisioning at scale using IaC tools such as Terraform, Bicep, or equivalent, including per-tenant resource automation and multi-region deployments.
  • Experience building monitoring and alerting for cryptographic services, including key access health and resource state observability.
  • Experience building large-scale, highly available, and reliable applications.
  • Experience with CI/CD pipelines and DevSecOps practices.

About the Company

Docusign

Runs electronic signing and agreement workflows

Docusign runs electronic signing and agreement management software for businesses, letting people approve contracts online and track the steps around each agreement. Its eSignature product routes documents to signers and records who signed, while contract lifecycle tools organize preparation, negotiation, and approvals. The Intelligent Agreement Management platform stores contracts in a searchable repository and uses AI to extract terms and connect agreement data to business workflows. Customers use its web applications or embed signing through APIs, and pay for subscriptions based on users, features, and document allowances. Docusign was founded in 2003 and is headquartered in San Francisco.

Company size
5,001-10,000
Company stage
IPO
Headquarters
San Francisco, CA
Founded
2003

Recently Posted Jobs

Explore more opportunities at Docusign

See more jobs