Staff Product Security Engineer, Secure Design (Kernel and Virtualization)

About DigitalOcean DigitalOcean is the AI-Native Cloud purpose-built for the inference and agentic era. Its five-layer integrated platform—spanning GPU and CPU infrastructure, core cloud, inference, data, and managed agent orchestration—is open throughout with no vendor lock-in, giving builders everything they need to start fast, scale production AI workloads, and improve unit economics. More than 650,000 customers and millions of developers globally trust DigitalOcean to build, ship, and scale their applications.

DigitalOcean

AI-Native Cloud. ☁️

Cloud ComputingCloud ServersVirtual HostingCloud HostingCloud InfrastructureSimple Hostingand Virtual Servers

D

digitalocean.com

1,001-5,000 employees

Software Development

Broomfield, Colorado

2012

Public Company

177k LinkedIn followers

Raised $2.7B

• Propose and implement mitigations and defense-in-depth to threats discovered
• through threat modeling the virtualization stack (90%)
• Provide deep technical expertise in systems architecture, kernel security
• features and network architecture to build out a threat model for our
• virtualization stack
• Identify the trade-offs of different solutions and recommend the efficient
• design to achieve both functional goals and security requirements. We do not
• deliver mandates; we work alongside cross-functional partners to find
• mutually beneficial solutions.
• Collaborate with development teams to implement remediations and defense in
• depth to protect DigitalOcean’s customers’ workloads.
• Mentor software engineering teams in security best practices.
• Help oversee our vulnerability management program (we call it security debt
• Help DigitalOcean engineers understand how security events impact them. Do
• they need to worry about the next Redfish

Required

• Deep familiarity with at least one kernel security feature (ex: AppArmor,
• SELinux, Landlock, etc.)
• Capable of assessing and understanding the performance implications of code
• changes to virtualization stacks (especially in Qemu and KVM), built from
• hands-on experience. Experience
• A record of partnering with internal engineering teams to tackle security
• problems across an entire stack with empathy and creativity. Engineering
• teams are our partners, not our adversaries.
• Ability to clearly communicate security topics and vulnerability classes
• (e.g. memory corruption, privilege escalation, TOCTOU, etc) and ability to
• provide actionable direction to product teams.
• Working knowledge of modern development concepts (virtualized environments,
• containerization, continuous integration + delivery).

Preferred

• 5+ years of writing systems level code (embedded systems, kernel, assembly or
• similar).
• Experience guiding software teams on secure architecture design.
• Written code for an embedded system (raspberry pi, arduino, etc).
• Experience building or reviewing threat models and ability to craft malicious
• user, attacker, and abuse/misuse cases.
• An understanding of patches and mitigations for hardware side-channel
• attacks.
• Familiarity with object oriented and functional programming concepts,
• particularly with languages such as Go, Rust, or C.

• $180,000-$215,000
• We innovate with purpose. You’ll be a part of a cutting-edge technology
• company with a high-growth trajectory, who are proud to simplify cloud and AI
• so builders can spend more time creating software that changes the world. As
• part of our team, you’ll embody our "Shark" mindset: bold, ambitious, and
• scrappy. You'll lead with a bias for action and take true ownership of our
• products, customer success, and team culture.
• We prioritize career development. At DigitalOcean, you’ll do the best work of
• your career. You will join a community of exceptional talent, collaborating
• closely with some of the brightest and most interesting people in the
• industry. We are a high-performance and fast-paced organization that will
• always challenge you to think big. Our talent development team prioritizes
• your professional development and provides resources to support your growth.
• We provide employees with reimbursement for relevant conferences, training,
• and education, subject to company policy.
• We care about your well-being. We take a comprehensive approach to our total
• rewards packages because we know different things drive different people. Our
• benefits are designed to support you and may include flexible time off, local
• team meetups, and mental health and well being support. Our benefits
• philosophy is consistent globally, but specific benefits and eligibility vary
• by location to reflect local needs and regulations.
• We reward our employees. The salary range for this position is based on
• market data, relevant years of experience, and skills. Eligible employees may
• also receive equity compensation, which may include a new hire equity grant
• and, in participating countries, the opportunity to participate in our
• Employee Stock Purchase Program. Equity awards are subject to approval and
• the terms of the applicable plan.
• Non-sales roles: In addition to base salary, this role is eligible to
• participate in DigitalOcean’s annual bonus plan and may be eligible for a
• new hire equity grant, subject to plan terms and local eligibility. Bonus
• amounts depend on company and individual performance.
• Sales roles (sales compensation eligible): In addition to base salary,
• this role may be eligible to earn incentive compensation under the
• applicable sales compensation plan and may be eligible for a new hire
• equity grant, subject to plan terms and local eligibility.
• DigitalOcean is an equal-opportunity employer. We do not discriminate on the
• Application Limit: You may apply to a maximum of 3 positions within any 180-day
• period. This policy promotes better role-candidate matching and encourages
• thoughtful applications where your qualifications align most strongly.