Staff Network Security Engineer

DigitalOcean is looking for a Staff Network Security Engineer to play a critical role in securing its global network infrastructure. You will act as a key technical leader, partnering with engineering teams to advise on secure architecture, architecting and building automated security tools, and championing best practices to ensure the network remains resilient against evolving threats across edge, backbone, and datacenter environments.

Key Responsibilities:

• Define and enforce network security architecture standards and principles so networks are architected with security as a foundational element.
• Provide technical leadership and mentorship to security and network engineering teams, serving as the subject matter expert on network security.
• Lead network security assessments, including threat modeling, intrusion detection, and protocol-level analysis to identify and mitigate sophisticated attack vectors.
• Develop and deploy advanced security automation, tooling, and infrastructure-as-code to continuously validate security posture and enforce compliance at scale.
• Collaborate with network engineers to integrate security controls and telemetry within SDN, BGP/MPLS, and network automation platforms.
• Participate in incident response efforts related to network security incidents.
• Drive the security review process for all network infrastructure and product changes, ensuring designs adhere to established standards before deployment.

Qualifications:

• 8-10 years of experience in network security engineering, network penetration testing, or security-focused infrastructure roles.
• Deep understanding of Layer 2/3/4 networking protocols (BGP, OSPF, IS-IS, VRRP, LACP) and their security implications.
• Deep understanding of DDoS attack vectors and mitigation strategies, including packet filtering, rate limiting, and scrubbing services.
• Extensive experience designing and building secure networks from the ground up, with proficiency in Python or Go for automation and tooling.
• Familiarity with Corero, Cloudflare, Juniper, Arista, or Ciena network platforms, plus strong Linux experience and familiarity with firewall, routing, and DNS security.
• Knowledge of MPLS, BGP-LU, and SDN architectures from a security perspective, and hands-on experience with observability tools like Prometheus, Grafana, and the ELK stack.
• Bonus: open-source contributions related to network security, or a background in security incident response or red/blue team operations.