Senior Product Security Engineer

Role Description

We’re looking for a Senior Product Security Engineer who is passionate about partnering with engineers to assess and mitigate the security risk of our virtualization stack. You'll own the security risk posture for our virtualization stack by:

• Building frameworks to reason about hypervisor risk, including systematic threat models that surface risks.
• Creating shared rubrics for assessing impact and likelihood of risks.
• Communicating risks clearly to security, kernel, virtualization, and provisioning teams.
• Designing and proposing defense-in-depth mitigations and driving their implementation.

As a member of the Product Security team, you will report to the Manager of Secure Design. The team’s scope includes:

• Reviewing early-stage decisions.
• Developing threat models.
• Scaling impact via automation.
• Curating security patterns.
• Authoring security guidance.
• Training and championing security initiatives.

What you’ll do:

• Propose and implement mitigations and defense-in-depth to threats discovered through threat modeling the virtualization stack (90%).
• Provide deep technical expertise in systems architecture, kernel security features, and network architecture.
• Identify trade-offs of different solutions and recommend efficient designs to achieve functional goals and security requirements.
• Collaborate with development teams to implement remediations and defense in depth.
• Cultivate and promote a security culture (10%).
• Mentor software engineering teams in security best practices.
• Help oversee our vulnerability management program (referred to as security debt).
• Help DigitalOcean engineers understand the impact of security events.

Qualifications

• Deep familiarity with at least one kernel security feature (e.g., AppArmor, SELinux, Landlock).
• Capable of assessing performance implications of code changes to virtualization stacks (especially in Qemu and KVM).
• A record of partnering with internal engineering teams to tackle security problems with empathy and creativity.
• Ability to clearly communicate security topics and vulnerability classes (e.g., memory corruption, privilege escalation, TOCTOU).
• Working knowledge of modern development concepts (virtualized environments, containerization, continuous integration + delivery).

Requirements

• 5+ years of writing systems level code (embedded systems, kernel, assembly, or similar).
• Experience guiding software teams on secure architecture design.
• Written code for an embedded system (e.g., Raspberry Pi, Arduino).
• Experience building or reviewing threat models and crafting malicious user, attacker, and abuse/misuse cases.
• Understanding of patches and mitigations for hardware side-channel attacks.
• Familiarity with object-oriented and functional programming concepts, particularly with languages such as Go, Rust, or C.

Benefits

• Competitive array of benefits, including Employee Assistance Program and Local Employee Meetups.
• Flexible time off policy.
• Reimbursement for relevant conferences, training, and education.
• Access to LinkedIn Learning's 10,000+ courses for continued growth and development.
• Salary range based on market data, relevant experience, and skills, with potential for bonuses and equity compensation.