Senior Product Security Engineer I

About the role

DigitalOcean is seeking a Senior Product Security Engineer to tackle large‑scale security challenges while reducing the burden on engineering teams. You will work within the Security Engineering team to embed security into developer lifecycles and help make the internet safer for everyone.

Key responsibilities

• Provide holistic assessments of security layers across infrastructure, application, people, and processes.
• Collaborate with product managers, designers, and engineers to threat model and architect secure, resilient systems.
• Review source code against secure coding best practices and contribute security requirements.
• Drive design and implementation of security services, tools, and libraries that deliver secure defaults.
• Promote security remediations in the CI/CD pipeline by building tools such as custom Semgrep implementations and developer‑first secrets management.
• Help build a platform that ensures software development at DigitalOcean is safe, easy, and low‑risk.
• Champion an internal security culture through developer training and internal CTFs.
• Educate engineers on the impact of security events like Log4j or RetBleed on DigitalOcean’s fleet.

Required profile

• Strong communication and stakeholder‑management skills, able to simplify complex security risks.
• Hands‑on experience in secure code reviews and threat modelling, comfortable writing well‑tested code.
• Working knowledge of modern development concepts such as virtualized environments, containerization, CI/CD, and public clouds (AWS/GCP).
• Experience with AI security frameworks (MITRE ATLAS, MAESTRO, OWASP Top 10 for LLMs/Agents/MCP) and mitigating AI‑related risks.
• Proven record of partnering with engineering teams to solve security problems across the stack.

Required skills

• Python
• JavaScript
• PHP
• Secure code review
• Threat modelling
• Virtualized environments
• Containerization
• CI/CD pipelines
• AWS
• GCP
• MITRE ATLAS
• MAESTRO
• OWASP Top 10 for LLMs
• Semgrep
• Secrets management
• System architecture
• Application architecture
• AI/ML pipeline security
• Hardware and software supply chain security