2 days ago
Base Salary
$204k - $306k/yr
Responsibilities
- Set technical direction for application, cloud infrastructure, and engineering-system security.
- Lead complex, multi-team security initiatives from problem definition and design through implementation, measurement, and ongoing ownership.
- Design and build scalable security services, controls, and automation for preventing, detecting, and remediating risks.
- Partner with engineering teams on threat modeling, architecture review, code review, risk prioritization, and mitigations.
- Strengthen secrets management, dependency security, vulnerability management, and CI/CD security controls.
- Evaluate security posture, define measurable security-program outcomes, and identify high-impact investments.
- Lead technical response to significant security incidents and implement lasting improvements.
- Establish secure-by-default patterns for cloud and application infrastructure, including infrastructure as code.
- Communicate security risks and recommendations to technical teams and company leaders.
- Mentor engineers and expand security knowledge through documentation and guidance.
Requirements
- Track record leading large, complex security-engineering initiatives across multiple teams from proposal through production.
- Deep experience in at least two areas including application security, product security, cloud security, infrastructure security, detection and response, or security automation.
- Strong software-engineering skills in one or more programming or scripting languages and experience building reliable production systems or internal platforms.
- Experience securing cloud environments and designing controls for identity, networking, data protection, secrets, logging, and workload security.
- Experience with threat modeling, architecture review, code review, and vulnerability analysis.
- Experience using infrastructure as code and CI/CD for repeatable, testable, and secure configurations.
- Sound judgment balancing security risk, engineering effort, product needs, and business priorities.
- Clear written and verbal communication skills and the ability to influence stakeholders with varied technical backgrounds.
- Ability to work from or relocate to New York City.
- Preferred qualifications include building and scaling security programs, securing multi-account or multi-cloud environments such as AWS and GCP, creating broadly adopted security platforms or paved-road patterns, leading high-severity incident response, and applying AI-assisted tooling to security analysis, remediation, or control validation.
Benefits
- The role is based in New York City, with the ability to work from or relocate to New York City required.
- Duolingo provides employee benefits focused on holistic well-being.
Tech Stack
Categories
About Duolingo
Duolingo builds a mobile-first platform for learning languages and basic skills, sold via a freemium app with ads and a subscription. It also operates the Duolingo English Test, an online, proctored language proficiency exam accepted by thousands of institutions. Founded in 2011 and headquartered in Pittsburgh, the company is publicly traded on Nasdaq (DUOL) and is expanding into subjects like math and early literacy.