Duo Security: What Their Hiring Reveals

2026-07-05

Source: HN Who is Hiring

Posted by: epage

Of the ten postings in this thread, Duo Security's is the most strategically revealing because it's a rare artifact: a company hiring into a crisis rather than despite one. The pandemic context (this is a March 2020 thread) reframes everything.

The Stack

Duo lists Python, Docker, Ansible, and AWS on the DevOps side, with Python on the backend and native mobile clients (iOS, Android, Windows) plus Chrome extensions. This is a boring, mature stack — and that's the point. Security infrastructure customers do not want cutting-edge experimentation on their auth path. Ansible over Kubernetes suggests a pragmatic ops culture that predates the container-orchestration hype cycle and hasn't felt the need to migrate. The multi-client surface area (mobile, desktop, browser) reveals the actual product shape: MFA lives wherever the user does, which is a much harder engineering problem than the backend suggests.

Stage and Direction

Two phrases do enormous work here: "not slowing down its hiring during all of this" and "recently acquired by Cisco." The first is a recruiting flex aimed at engineers watching layoff announcements roll across their timelines. The second signals financial insulation — a post-acquisition budget backed by Cisco means Duo can hire counter-cyclically while independent startups freeze. The explicit callout of "Zero Trust / Beyond Corp" and "transition to remote" shows they've already repositioned their pitch around the pandemic — MFA became a compliance nice-to-have overnight into a business-continuity requirement.

Skills and Trends

Flags

Green: Remote-friendly (Ann Arbor, Austin, Remote) before that was table stakes; a Cisco acquisition removes runway risk; a poster who works there (epage) writing in first person rather than an HR template.

Yellow: "I know our backend is written in Python" is a tell that epage is DevOps and doesn't own the backend — the posting is one engineer's honest take, not a coordinated recruiting effort. Also, no salary band, no team-size numbers, no specific role level. It's more of a "we exist and we're open" flag than a targeted req.

The signal: Security vendors owned by megacaps are the counter-cyclical winners of the remote-work shock — Zero Trust just became a budget line no CISO can defer.

All newsletters