Software Engineer II - Key Management Systems

Dive in and do the best work of your career at DigitalOcean. Journey alongside a strong community of top talent who are relentless in their drive to build the simplest scalable cloud. If you have a growth mindset, naturally like to think big and bold, and are energized by the fast-paced environment of a true industry disruptor, you’ll find your place here. We value winning together—while learning, having fun, and making a profound difference for the dreamers and builders in the world.

We are seeking a Software Engineer II to join our Security Products team working on Key Management Systems (KMS). Our KMS platform is foundational to DigitalOcean's security posture, managing the full lifecycle of cryptographic keys that protect customer data across the platform, from envelope encryption for block storage and databases to API credential management and secrets handling.

In this role, you will contribute meaningfully to building and maintaining the systems that power DigitalOcean's key management platform. You will work within established technical frameworks, implement features against well-scoped designs, and grow your expertise in applied cryptography and security engineering. If you are passionate about writing clean, reliable code and want to develop deep expertise in cryptographic systems, this is the team for you.

• Build & Extend: Implement features and bug fixes across DigitalOcean's key management services in Go, working within established architectural patterns and contributing to a high-reliability, security-critical platform.

• Contribute to Key Lifecycle Systems: Work on key generation, rotation, and revocation workflows, learning the cryptographic principles deeply and contributing to reliable, well-tested implementations.

• Write Quality Code: Participate in code reviews, write comprehensive unit and integration tests, and maintain high engineering standards — with particular attention to the correctness requirements of security-sensitive code.

• Operate What You Build: Participate in on-call rotations, investigate production issues, write runbooks, and develop operational ownership of the services you contribute to.

• Support Envelope Encryption Work: Implement data encryption key (DEK) wrapping and unwrapping logic using established key encryption key (KEK) hierarchies, translating well-defined requirements into working, tested code.

• Learn & Grow: Partner with senior engineers to develop your understanding of HSM integration, cryptographic protocol design, and compliance requirements (FIPS 140-2, SOC 2) — building the skills to take on increasing ownership over time.

• Collaborate Cross-Functionally: Work with teammates across IAM, Storage, and Database teams to understand how your work fits into the broader platform security model.

What You'll Add to DigitalOcean

• Experience: 2–4 years of software engineering experience, with a strong foundation in building and shipping production services.

• Language Proficiency: Proficiency in Go or a strong background in another typed systems language with demonstrated ability to ramp quickly.

• Security Fundamentals: Understanding of core cryptographic concepts — symmetric vs. asymmetric encryption, key derivation, hashing — and genuine curiosity to go deeper into applied cryptography.

• Systems Thinking: Understanding of how distributed systems work — replication, latency trade-offs, failure modes — with an appreciation for the higher stakes of failures in security-critical systems.

• Cloud