Staff Security Engineer

• Our mission at Duolingo is to develop the best education in the world and make it universally available. It's a big mission, and that's where you come in!
• At Duolingo, you'll join a team that cares about finding innovative solutions to complex technical problems , running countless experiments (300+ at a time!) with our massive user base to make data-driven decisions, and educating our users and employees alike.
• You'll have limitless learning opportunities, mentorship and collaboration with world-class minds, and a variety of projects with large scopes — while doing work that's both fun and meaningful.
• Join our life-changing mission to develop education for our half a billion (and growing!) learners around the world.

About the role

• As a Staff Security Engineer, you will shape and deliver Duolingo's security strategy, safeguarding our learners, employees, systems, and services.
• You'll identify the highest-impact security problems, lead complex initiatives from proposal through production, and build durable security capabilities across our applications and cloud infrastructure.
• Working across Engineering, Product, Legal, Finance, and IT, you'll make practical risk decisions, establish secure-by-default patterns, and help teams ship safely at scale.
• This role is based in New York City.
• We know great candidates bring different combinations of experience.
• If you meet some or most of the

qualifications

below, we encourage you to apply!

:brain: You will...

• Set technical direction for security across Duolingo's applications, cloud infrastructure, and engineering systems.
• Lead complex, multi-team security initiatives from problem definition and design through implementation, measurement, and ongoing ownership.
• Design and build scalable security services, controls, and automation that prevent, detect, and remediate risks with minimal manual effort.
• Partner with engineering teams to threat model systems, review architecture and code, prioritize risks, and deliver practical mitigations.
• Strengthen security across the software-development lifecycle, including secrets management, dependency security, vulnerability management, and CI/CD controls.
• Evaluate Duolingo's security posture, use evidence to identify the highest-impact investments, and define measurable outcomes for security programs.
• Lead technical response to significant security incidents and translate lessons learned into lasting improvements.
• Establish reusable secure-by-default patterns for cloud and application infrastructure, including infrastructure as code.
• Communicate technical risks, tradeoffs, and recommendations clearly to engineering teams and company leaders.
• Mentor engineers, scale security knowledge through documentation and guidance, and raise the technical bar across Engineering.

:check: You have...

• A track record of leading large, complex security engineering initiatives across multiple teams from proposal through production.
• Deep experience in at least two of the following areas: application security, product security, cloud security, infrastructure security, detection and response, or security automation.
• Strong software-engineering skills in one or more programming or scripting languages and experience building reliable production systems or internal platforms.
• Experience securing cloud environments and designing controls for identity, networking, data protection, secrets, logging, and workload security.
• Experience applying threat modeling, architecture review, code review, and vulnerability analysis to real-world systems.
• Experience using infrastructure as code and CI/CD to deliver repeatable, testable, and secure configurations.
• Sound judgment in balancing security risk, engineering effort, product needs, and business priorities.
• Clear written and verbal communication skills, including the ability to influence stakeholders with different technical backgrounds.
• The ability to work from or relocate to New York City.

:star: Exceptional candidates will have...

• Experience building a security program or technical capability from an early stage and scaling it across an engineering organization.
• Experience securing large, multi-account or multi-cloud environments, particularly AWS and GCP.
• Experience creating security platforms or paved-road patterns adopted broadly by engineers.
• Experience leading high-severity incident response and driving durable improvements afterward.
• Experience applying AI-assisted tooling to security analysis, remediation, or control validation.

• The offered salary is dependent upon several factors, including work experience, skills, and internal peer comparisons.
• The posted range is subject to change in the future.
• For this role, base salary is supplemented by equity compensation.
• We encourage you to talk with your recruiter for more information related to compensation for this role!

Salary Range:

$204,000 — $306,000 USD

Benefits

Take a peek at how we care for our employees' holistic well-being with our benefits here .

We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

• Duolingo and our employees will never ask for your Social Security number, bank details, or passport info, and we'll never ask you to deposit a check, purchase equipment, or exchange money during the interview process.
• Real Duolingo employees always use an email that ends in @duolingo.com or @recruiting.duolingo.com.
• Stay alert and double-check these details before sharing any information.
• By applying for this position your data will be processed as per the Duolingo Applicant Privacy Notice .