About the role
Our mission at Duolingo is to develop the best education in the world and make it universally available. It’s a big mission, and that’s where you come in!
At Duolingo, you’ll join a team that cares about finding innovative solutions to complex technical problems, running countless experiments (300+ at a time!) with our massive user base to make data-driven decisions, and educating our users and employees alike. You’ll have limitless learning opportunities, mentorship and collaboration with world-class minds, and a variety of projects with large scopes — while doing work that’s both fun and meaningful.
Join our life-changing mission to develop education for our half a billion (and growing!) learners around the world.
About the role
As a Staff Security Engineer, you will shape and deliver Duolingo’s security strategy, safeguarding our learners, employees, systems, and services. You’ll identify the highest-impact security problems, lead complex initiatives from proposal through production, and build durable security capabilities across our applications and cloud infrastructure. Working across Engineering, Product, Legal, Finance, and IT, you’ll make practical risk decisions, establish secure-by-default patterns, and help teams ship safely at scale. This role is based in New York City. We know great candidates bring different combinations of experience. If you meet some or most of the qualifications below, we encourage you to apply!
:brain: You will...
- Set technical direction for security across Duolingo’s applications, cloud infrastructure, and engineering systems.
- Lead complex, multi-team security initiatives from problem definition and design through implementation, measurement, and ongoing ownership.
- Design and build scalable security services, controls, and automation that prevent, detect, and remediate risks with minimal manual effort.
- Partner with engineering teams to threat model systems, review architecture and code, prioritize risks, and deliver practical mitigations.
- Strengthen security across the software-development lifecycle, including secrets management, dependency security, vulnerability management, and CI/CD controls.
- Evaluate Duolingo’s security posture, use evidence to identify the highest-impact investments, and define measurable outcomes for security programs.
- Lead technical response to significant security incidents and translate lessons learned into lasting improvements.
- Establish reusable secure-by-default patterns for cloud and application infrastructure, including infrastructure as code.
- Communicate technical risks, tradeoffs, and recommendations clearly to engineering teams and company leaders.