Senior Software Engineer II - KMS
DigitalOcean2 months ago
Bengaluru, IndiaSenior
Responsibilities
- Design and build high-availability, security-critical key management services in Go from design through production operation.
- Design and implement key generation, rotation, escrow, and destruction workflows with correctness guarantees and audit trails.
- Design and scale DEK/KEK envelope-encryption hierarchies for customer data across Storage, Databases, and Inference workloads.
- Integrate FIPS 140-2 and SOC 2 requirements into engineering design, including audit logging, key material handling, and cryptographic algorithm governance.
- Identify and remediate vulnerabilities including side-channel exposure and privilege escalation risks in key access APIs.
- Improve KMS reliability and performance and lead incident response and postmortems for security-sensitive production events.
- Mentor IC2 engineers through code reviews and design feedback in applied cryptography and security engineering.
Requirements
- 6+ years of software engineering experience, including at least 2–3 years focused on cryptographic systems, key management, or security-critical distributed services.
- Strong proficiency in Go and solid understanding of gRPC microservices architecture.
- Working knowledge of AES-GCM, RSA, ECDSA, HMAC, HKDF, and PBKDF2, including correct practical usage.
- Hands-on experience with Hardware Security Modules or cloud KMS services such as AWS KMS, GCP Cloud KMS, HashiCorp Vault, or Thales/Luna.
- Understanding of FIPS 140-2 requirements and familiarity with SOC 2 or other audit frameworks as applied to key management.
- Understanding of consensus, replication, and partitioning for distributed systems operating under failure conditions.
- Hands-on experience with Kubernetes, SQL/MySQL, and Terraform.
- Ability to collaborate across IAM, Storage, Databases, and Inference teams and communicate security trade-offs to technical and non-technical stakeholders.
- Experience with secrets management platforms such as HashiCorp Vault and AWS Secrets Manager is preferred.
- Familiarity with PKCS#11, KMIP, or other HSM interface and key management interoperability standards is preferred.
- Experience with customer-facing encryption products such as BYOK, CMEK, or customer-managed secrets is preferred.
Benefits
- Hybrid role located in Bengaluru, India.
- Reimbursement for relevant conferences, training, and education.
- Access to LinkedIn Learning courses.
- Employee Assistance Program, local employee meetups, and flexible time off.
- Bonus and equity compensation may be available, including equity grants upon hire and an Employee Stock Purchase Program.
About DigitalOcean
DigitalOcean provides cloud infrastructure and platform services for developers, startups, and small to mid-sized businesses, including virtual machines (Droplets), managed Kubernetes and databases, object/block storage, networking, and GPUs for AI workloads. It operates a usage-based, self-service public cloud with APIs, CLI, and a marketplace to deploy and scale applications. Founded in 2012 and headquartered in Broomfield, Colorado, DigitalOcean is a public company listed on the NYSE.