Senior Director, Product Security

Company Overview Docusign brings agreements to life. Over 1.5 million customers and more than a billion people in over 180 countries use Docusign solutions to accelerate the process of doing business and simplify people’s lives. With intelligent agreement management, Docusign unleashes business-critical data that is trapped inside of documents. Until now, these were disconnected from business systems of record, costing businesses time, money, and opportunity. Using Docusign’s Intelligent Agreement Management platform, companies can create, commit, and manage agreements with solutions created by the #1 company in e-signature and contract lifecycle management (CLM). What you'll do As the most trusted brand in our industry, Docusign recognizes the profound importance of maintaining and enhancing customer trust in our products. The Senior Director, Product Security leads all aspects of the Docusign Product Security program. The Senior Director will be a product focused, technically proficient leader who manages the development of products and features to provide for the security and trust of the platform. This role has responsibility for the secure software development lifecycle (SDLC) and continuous integration/continuous deployment (CI/CD) for products developed for customers as well as internal usage at Docusign. The Senior Director and their team of security engineers and architects embed within Product, Technology, and Digital Technology teams to manage product development, security controls, and processes to ensure optimal security by design and default while supporting business objectives. The Senior Director will integrate leading security practices into all phases of product development – including planning, design, implementation, testing, deployment and maintenance – to proactively reduce vulnerabilities and broader risks. The role will oversee developer technical designs (e.g., secure coding criteria, architectural designs, developer libraries, code reviews, etc.), as well as SDLC and CI/CD processes, gating, and execution. In particular, the Senior Director will implement leading security practices directly into the software delivery pipeline, ensuring code integrity from development to production, and mitigate risks while performing automated scanning, testing, and compliance checks at every stage and remediation as required. The Senior Director will implement contemporary, cost-effective tools and practices to maximize efficiencies while providing appropriate technical security rigor. They will leverage emerging tools, like AI guardrails and AI-native tools that provide code context reasoning, to protect against longstanding security risks (e.g., OWASP Top 10) and more sophisticated and developing threats (e.g., OWASP Top 10 for Agentic Applications). The Senior Director will lead a robust Security Champions program to scale security awareness, implement secure coding principles, and empower developer-led code reviews and risk mitigation where appropriate. They will work closely with Docusign’s Red Team and PSIRT to proactively identify and remediate vulnerabilities and systemic risks. And they will provide deep, technical expertise in leading the Product Security team, advising senior leaders, and shaping the behaviors of cross-functional teams. This position is a people manager role reporting to the Chief Information Security Officer. Responsibility Manage product security from design through release and maintenance Embed with Product, Technology, and Digital Technology teams to oversee product and developer technical designs; manage SDLC and CI/CD processes, gating, and standards; and ensure Docusign products are secure Maintain deep technical expertise in components/capabilities of the product ecosystem Maintain deep technical expertise in security threats, trends, technologies, and industry best practices (existing and emerging) Manage efficient, effective security solutions aligned with business needs (e.g., support continuing improvements in automating CI/CD pipelines that leverage infrastructure as code with tools like Terraform plus containerization; e.g., support secure development of Intelligent Agreement Management within the Docusign platform plus secure development of AI capabilities for internal company usage of AI capabilities) Manage, lead, and train their team of security engineers and architects to implement and maintain a high performing product security program that implements best practices Implement contemporary tooling and automation to optimize insights, efficiency, and efficacy while enhancing technical security rigor Contribute to technical requirements, architectural design and modification, interface design documents, and educational resources Serve as a senior escalation point for complex or high risk vulnerabilities; drive architectural, process, and implementation improvements from lessons learned Build a high-performing, product-driven team focused on measurable outcomes and continuous improvement; implement tailored program goals, objectives, milestones, key results, and key performance indicators to drive consistent progress and outcomes Ensure products meet internal security standards, industry frameworks, and regulatory requirements Serve as a trusted leader/advisor to the CISO, other executives, and teams – translating technical risk into business impact, providing clear updates, trade-offs, and advice Build collaboration and effective relationships with cross-functional teams to ensure frictionless security and paved path approaches with engineering leadership Job Designation Hybrid: Employee divides their time between in-office and remote work. Access to an office location is required. (Frequency: Minimum 2 days per week; may vary by team but will be weekly in-office expectation) Positions at Docusign are assigned a job designation of either In Office, Hybrid or Remote and are specific to the role/job. Preferred job designations are not guaranteed when changing positions within Docusign. Docusign reserves the right to change a position's job designation depending on business needs and as permitted by local law. What you bring Basic 12+ years in Product Security, Application Security, or closely related security and engineering disciplines, with 8+ years in highly technical leadership roles Bachelor’s degree in computer science, data science, artificial intelligence, machine learning, cybersecurity, risk management, or a related technical field Experience designing and leading product security programs, including but not limited to technical architecture/secure design reviews, threat modeling, secure coding principles and checklists, security tooling and scanning, security champions, SDLC, CI/CD, automating pipelines and gates, vulnerability management, and remediation Experience with common security vulnerabilities (e.g., OWASP Top 10, API Security Top 10, Agentic Top 10, open source software/supply chain, etc.) and their remediations, and addressing the full range of software risks across products and with cross-functional teams such as Product, Technology, and PSIRT Experience with benchmarks for AI such as Xbow, CVE-Bench Bounty-bench and others as well as the need for AI benchmarks and requirements Experience in implementing or improving product security tools where they previously did not exist, did not perform to expectations, and/or better options emerged (e.g., static and dynamic analysis tools, including vulnerability scanning suites) Experience in implementing or improving product security gates where they previously did not exist, did not perform to expectations, and/or better options emerged Experience embedding security within partner engineering teams through distributed training and enablement in a program, such as Security Champions Experience with development and build pipelines and automating CI/CD Experience with cloud infrastructure using infrastructure as code Experience with securing AI/ML implementations Experience with securely developing APIs and associated tooling against threats, such as unauthorized access and data compromise Experience with identity verification and cryptography Experience in one or more programming languages relevant to the organization (e.g., C#/.NET Framework/Core, Python, Java, JavaScript) Experience defining security KPIs, metrics pipelines, and executive reporting frameworks Preferred Certifications: CISSP, CSSLP, CISM, CCISO, GSLC, CASE, OSWE, or equivalent Substantial experience in AI product security, including AI guardrails, model scanning, agentic development standards, and AI-specific risks (e.g., OWASP Top 10 for Agentic Applications, OWASP Top 10 for LLM Applications) Knowledge of AI governance frameworks (e.g., AI RMF, ISO 42001) Experience driving automation strategies, predictive analytics, and data-driven insights Former experience as a software developer and/or engineer Master’s degree or higher Deeply technical with strong strategic vision, tactical acumen, excellence in execution Forward looking and acting; must understand and address current and future threats and business requirements exceedingly well and manage products and her team to suit Superb cross-functional collaboration and stakeholder engagement across technical and business relationships, especially with Product, Technology, Digital Technology, Security, and executive teams Growth and product mindset; oriented to action and delivery; professional teammate Wage Transparency Pay for this position is based on a number of factors including geographic location and may vary depending on job-related knowledge, skills, and experience. Based on applicable legislation, the below details pay ranges in the following locations: California: $244,000.00 - $390,575.00 base salary Washington, Maryland, New Jersey and New York (including NYC metro area): $228,400.00 - $344,575.00 base salary This role is also eligible for the following: Bonus: Sales personnel are eligible for variable incentive pay dependent on their achievement of pre-established sales goals. Non-Sales roles are eligible for a company bonus plan, which is calculated as a percentage of eligible wages and dependent on company performance. Stock: This role is eligible to receive Restricted Stock Units (RSUs). Global benefits provide options for the following: Paid Time Off: earned time off, as well as paid company holidays based on region Paid Parental Leave: take up to six months off with your child after birth, adoption or foster care placement Full Health Benefits Plans: options for 100% employer paid and minimum employee contribution health plans from day one of employment Retirement Plans: select retirement and pension programs with potential for employer contributions Learning and Development: options for coaching, online courses and education reimbursements Compassionate Care Leave: paid time off following the loss of a loved one and other life-changing events Life at DocuSign Working here Docusign is committed to building trust and making the world more agreeable for our employees, customers and the communities in which we live and work. You can count on us to listen, be honest, and try our best to do what’s right, every day. At Docusign, everything is equal. We each have a responsibility to ensure every team member has an equal opportunity to succeed, to be heard, to exchange ideas openly, to build lasting relationships, and to do the work of their life. Best of all, you will be able to feel deep pride in the work you do, because your contribution helps us make the world better than we found it. And for that, you’ll be loved by us, our customers, and the world in which we live. Accommodation Docusign is committed to providing reasonable accommodations for qualified individuals with disabilities in our job application procedures. If you need such an accommodation, or a religious accommodation, during the application process, please contact us at [email protected]. If you experience any issues, concerns, or technical difficulties during the application process please get in touch with our Talent organization at [email protected] for assistance. Applicant and Candidate Privacy Notice States Not Eligible for Employment This position is not eligible for employment in the following states: Alaska, Hawaii, Maine, Mississippi, North Dakota, South Dakota, Vermont, West Virginia and Wyoming. EEO Statement It's important to us that we build a talented team that is as diverse as our customers and where all employees feel a deep sense of belonging and thrive. We encourage great talent who bring a range of perspectives to apply for our open positions. Docusign is an Equal Opportunity Employer and makes hiring decisions based on experience, skill, aptitude and a can-do approach. We will not discriminate based on race, ethnicity, color, age, sex, religion, national origin, ancestry, pregnancy, sexual orientation, gender identity, gender expression, genetic information, physical or mental disability, registered domestic partner status, caregiver status, marital status, veteran or military status, or any other legally protected category. EEO Know Your Rights poster