Staff Security Engineer

About this role

Shape Duolingo’s security strategy and build durable security capabilities across applications, cloud infrastructure, and engineering systems. Lead cross-functional security initiatives, help teams make practical risk decisions, and strengthen secure-by-default practices at scale.

About the company

Duolingo is a language-learning platform that offers a variety of courses and tools to help users learn new languages through interactive exercises and innovative technologies. The company also develops educational products like Duolingo Math and employs a range of professionals to enhance its services.

What you'll do

• Set technical direction for application, cloud, and engineering-systems security
• Lead multi-team security initiatives from design through production and ongoing ownership
• Build scalable security services, controls, and automation
• Partner with engineering teams on threat modeling, architecture and code reviews, and risk mitigation
• Improve security across the software development lifecycle, including secrets, dependencies, vulnerabilities, and CI/CD
• Lead technical response to significant security incidents and drive lasting improvements
• Establish secure-by-default cloud and infrastructure-as-code patterns
• Mentor engineers and communicate security risks and recommendations to stakeholders

What we're looking for

• Track record leading complex security engineering initiatives across multiple teams
• Deep experience in at least two areas: application or product security, cloud or infrastructure security, detection and response, or security automation
• Strong programming or scripting skills and experience building reliable production systems or internal platforms
• Experience securing cloud environments, including identity, networking, data protection, secrets, logging, and workload security
• Experience with threat modeling, architecture and code reviews, and vulnerability analysis
• Experience using infrastructure as code and CI/CD to deliver secure, repeatable configurations
• Sound risk judgment and clear written and verbal communication
• Ability to work from or relocate to New York City

Nice to have

• Experience building and scaling a security program or technical capability
• Experience securing large multi-account or multi-cloud environments, especially AWS and GCP
• Experience creating security platforms or paved-road patterns adopted broadly by engineers
• Experience leading high-severity incident response
• Experience applying AI-assisted tooling to security analysis, remediation, or control validation

Benefits

• Equity compensation