Staff Security Engineer

Duolingo is seeking a Staff Security Engineer to advance its security strategy through complex, cross-team initiatives and the delivery of scalable security capabilities across applications and cloud infrastructure. This onsite role is based in New York City and emphasizes secure-by-default patterns, incident response, and clear risk communication.

Location

New York, NY (onsite)

Compensation

USD 204,000 - 306,000 per year

Responsibilities

• Set technical direction for security across Duolingo’s applications, cloud infrastructure, and engineering systems.
• Lead complex, multi-team security initiatives from problem definition and design through implementation, measurement, and ongoing ownership.
• Design and build scalable security services, controls, and automation to prevent, detect, and remediate risks with minimal manual effort.
• Partner with engineering teams on threat modeling, architecture and code reviews, risk prioritization, and practical mitigation delivery.
• Strengthen security across the software-development lifecycle, including secrets management, dependency security, vulnerability management, and CI/CD controls.
• Evaluate Duolingo’s security posture using evidence to identify highest-impact investments and define measurable security outcomes.
• Lead technical response to significant security incidents and convert lessons learned into durable improvements.
• Establish reusable secure-by-default patterns for cloud and application infrastructure, including infrastructure as code.
• Communicate technical risks, tradeoffs, and recommendations to engineering teams and company leaders.
• Mentor engineers by scaling security knowledge through documentation and guidance, raising the technical bar across Engineering.

Requirements

• A track record of leading large, complex security engineering initiatives across multiple teams from proposal through production.
• Deep experience in at least two of the following: application security, product security, cloud security, infrastructure security, detection and response, or security automation.
• Strong software-engineering skills in one or more programming or scripting languages, including experience building reliable production systems or internal platforms.
• Experience securing cloud environments and designing controls for identity, networking, data protection, secrets, logging, and workload security.
• Experience applying threat modeling, architecture review, code review, and vulnerability analysis to real-world systems.
• Experience using infrastructure as code and CI/CD to deliver repeatable, testable, and secure configurations.
• Sound judgment balancing security risk, engineering effort, product needs, and business priorities.
• Clear written and verbal communication skills, including the ability to influence stakeholders with different technical backgrounds.
• Ability to work from or relocate to New York City.

Benefits

• Benefits: Take a peek at how Duolingo cares for employees’ holistic well-being with the benefits listed on their page.
• Job Alerts: Sign up for job alerts.
• Accommodations: Duolingo will make reasonable efforts to ensure interviews are conducted in an environment that fairly and accurately assesses skills. For assistance, contact [email protected].

Exceptional Candidates

• Experience building a security program or technical capability from an early stage and scaling it across an engineering organization.
• Experience securing large, multi-account or multi-cloud environments, particularly AWS and GCP.
• Experience creating security platforms or paved-road patterns adopted broadly by engineers.
• Experience leading high-severity incident response and driving durable improvements afterward.
• Experience applying AI-assisted tooling to security analysis, remediation, or control validation.