Staff Security Engineer

Duolingo • New York, NY

2h • $204,000 - $306,000 • Onsite

About The Position

As a Staff Security Engineer at Duolingo, you will shape and deliver the company’s security strategy, safeguarding learners, employees, systems, and services. You will identify high-impact security problems, lead complex initiatives from proposal through production, and build durable security capabilities across applications and cloud infrastructure. Working across Engineering, Product, Legal, Finance, and IT, you will make practical risk decisions, establish secure-by-default patterns, and help teams ship safely at scale. The role is based in New York City. Candidates who meet some or most of the listed qualifications are encouraged to apply.

Requirements

• A track record of leading large, complex security engineering initiatives across multiple teams from proposal through production.
• Deep experience in at least two of the following areas: application security, product security, cloud security, infrastructure security, detection and response, or security automation.
• Strong software-engineering skills in one or more programming or scripting languages, and experience building reliable production systems or internal platforms.
• Experience securing cloud environments and designing controls for identity, networking, data protection, secrets, logging, and workload security.
• Experience applying threat modeling, architecture review, code review, and vulnerability analysis to real-world systems.
• Experience using infrastructure as code and CI/CD to deliver repeatable, testable, and secure configurations.
• Sound judgment in balancing security risk, engineering effort, product needs, and business priorities.
• Clear written and verbal communication skills, including the ability to influence stakeholders with different technical backgrounds.
• Ability to work from or relocate to New York City.

Nice To Haves

• Experience building a security program or technical capability from an early stage and scaling it across an engineering organization.
• Experience securing large, multi-account or multi-cloud environments, particularly AWS and GCP.
• Experience creating security platforms or paved-road patterns adopted broadly by engineers.
• Experience leading high-severity incident response and driving durable improvements afterward.
• Experience applying AI-assisted tooling to security analysis, remediation, or control validation.

Responsibilities

• Set technical direction for security across Duolingo’s applications, cloud infrastructure, and engineering systems.
• Lead complex, multi-team security initiatives from problem definition and design through implementation, measurement, and ongoing ownership.
• Design and build scalable security services, controls, and automation to prevent, detect, and remediate risks with minimal manual effort.
• Partner with engineering teams to threat model systems, review architecture and code, prioritize risks, and deliver practical mitigations.
• Strengthen security across the software-development lifecycle, including secrets management, dependency security, vulnerability management, and CI/CD controls.
• Evaluate Duolingo’s security posture, use evidence to identify high-impact investments, and define measurable outcomes for security programs.
• Lead technical response to significant security incidents and translate lessons learned into lasting improvements.
• Establish reusable secure-by-default patterns for cloud and application infrastructure, including infrastructure as code.
• Communicate technical risks, tradeoffs, and recommendations clearly to engineering teams and company leaders.
• Mentor engineers, scale security knowledge through documentation and guidance, and raise the technical bar across Engineering.

Benefits

• Equity compensation supplements base salary.
• Employee benefits supporting holistic well-being are available; specific benefits are not listed in the posting.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed