Senior Software Engineer II - KMS
DigitalOcean5 hours ago
Responsibilities
- Design and build high-availability, security-critical key management services in Go from design through production operation.
- Design and implement key generation, rotation, escrow, and destruction workflows with correctness guarantees and audit trails.
- Design and scale DEK/KEK envelope-encryption hierarchies for customer data across Storage, Databases, and Inference workloads.
- Integrate FIPS 140-2 and SOC 2 requirements into engineering design, including audit logging, key material handling, and cryptographic algorithm governance.
- Identify and remediate vulnerabilities including side-channel exposure and privilege escalation risks in key access APIs.
- Improve KMS reliability and performance and lead incident response and postmortems for security-sensitive production events.
- Mentor IC2 engineers through code reviews and design feedback in applied cryptography and security engineering.
Requirements
- 6+ years of software engineering experience, including at least 2–3 years focused on cryptographic systems, key management, or security-critical distributed services.
- Strong proficiency in Go and solid understanding of gRPC microservices architecture.
- Working knowledge of AES-GCM, RSA, ECDSA, HMAC, HKDF, and PBKDF2, including correct practical usage.
- Hands-on experience with Hardware Security Modules or cloud KMS services such as AWS KMS, GCP Cloud KMS, HashiCorp Vault, or Thales/Luna.
- Understanding of FIPS 140-2 requirements and familiarity with SOC 2 or other audit frameworks as applied to key management.
- Understanding of consensus, replication, and partitioning for distributed systems operating under failure conditions.
- Hands-on experience with Kubernetes, SQL/MySQL, and Terraform.
- Ability to collaborate across IAM, Storage, Databases, and Inference teams and communicate security trade-offs to technical and non-technical stakeholders.
- Experience with secrets management platforms such as HashiCorp Vault and AWS Secrets Manager is preferred.
- Familiarity with PKCS#11, KMIP, or other HSM interface and key management interoperability standards is preferred.
- Experience with customer-facing encryption products such as BYOK, CMEK, or customer-managed secrets is preferred.
Benefits
- Hybrid role located in Bengaluru, India.
- Reimbursement for relevant conferences, training, and education.
- Access to LinkedIn Learning courses.
- Employee Assistance Program, local employee meetups, and flexible time off.
- Bonus and equity compensation may be available, including equity grants upon hire and an Employee Stock Purchase Program.
About DigitalOcean
DigitalOcean is the AI-Native Cloud purpose-built for the inference and agentic era. Its five-layer integrated platform—spanning GPU and CPU infrastructure, core cloud, inference, data, and managed agent orchestration—is open throughout with no vendor lock-in, giving builders everything they need to start fast, scale production AI workloads, and improve unit economics. More than 650,000 customers and millions of developers globally trust DigitalOcean to build, ship, and scale their applications.