Senior Software Engineer – Key Management Systems

About the role

Dive into DigitalOcean’s Security Products team to own and evolve the Key Management System (KMS) platform, a core component protecting customer data across storage, databases and APIs. You will design, build and operate high‑availability, security‑critical services in Go while shaping cryptographic architecture and compliance practices.

Key responsibilities

• Design and implement high‑availability KMS services in Go, covering the full key lifecycle from generation to destruction.
• Lead key‑lifecycle engineering, including rotation, escrow and audit‑trail mechanisms.
• Develop and scale envelope‑encryption hierarchies (DEK/KEK) for storage, databases and inference workloads.
• Integrate compliance requirements such as FIPS 140‑2 and SOC 2 into system design and audit logging.
• Identify and remediate security vulnerabilities, including side‑channel risks and privilege‑escalation paths.
• Drive reliability and performance improvements, and lead incident response for security‑sensitive events.
• Mentor junior engineers through code reviews and design guidance.

Required profile

• 4–7 years of software engineering experience, with 1–2 years focused on cryptographic systems or security‑critical distributed services.
• Strong proficiency in Go and experience building gRPC microservices.
• Hands‑on experience with HSMs or cloud KMS solutions (AWS KMS, GCP Cloud KMS, HashiCorp Vault, etc.).
• Familiarity with FIPS 140‑2, SOC 2 or similar compliance frameworks.
• Understanding of distributed systems concepts such as consensus, replication and partition tolerance.
• Practical experience with Kubernetes, MySQL and Infrastructure‑as‑Code tools like Terraform.

Required skills

• Go
• gRPC
• Kubernetes
• MySQL
• Terraform
• AES‑GCM, RSA, ECDSA, HMAC, HKDF, PBKDF2
• Hardware Security Modules (HSM)
• AWS KMS, GCP Cloud KMS, HashiCorp Vault
• FIPS 140‑2, SOC 2 compliance
• PKCS#11, KMIP (optional)