Senior Application Security Engineer – Security Platform

About the role

DigitalOcean is seeking a Senior Application Security Engineer to join its Security Platform team. You will partner with engineering groups to embed security into new products and features, driving the operation and improvement of AppSec tooling across the organization.

Key responsibilities

• Operate and enhance deployed AppSec tooling such as SAST, SCA, and secrets management, turning findings into actionable priorities.
• Develop and maintain custom Semgrep rules to create guardrails for safe engineering practices.
• Design internal tooling that provides secure‑by‑default configurations and libraries for engineering teams.
• Write robust, maintainable software primarily in Go and Python, occasionally contributing to frontend components.
• Collaborate with other security teams to drive secure software design and reduce organizational risk.

Required profile

• 5+ years of software engineering experience with a security focus, delivering projects in Go, Python, or JavaScript.
• Experience building or reviewing threat models and crafting malicious user, attacker, and abuse scenarios.
• Working knowledge of hardware and software supply‑chain security.
• Ability to clearly communicate security topics, vulnerability classes, and the benefits of security solutions.
• Proven track record of partnering empathetically with internal engineering teams to solve security problems.

Required skills

• Go, Python, JavaScript programming.
• SAST and SCA tooling, including Semgrep.
• gRPC, Docker, Prometheus, Kubernetes.
• HashiCorp Vault and GitHub Actions.
• Microservice architectures and event‑driven processing.