Join Strava as a Senior Security Engineer II to protect a platform supporting millions of athletes through proactive security practices.
Posted by employer 1 day ago
First seen on Joblaze 3 hours ago
Last verified on the company career page 3 hours ago
What you'll build
- Ensure Strava’s applications and infrastructure are secure
- Design and implement secure architectures
- Shape how Strava manages application and infrastructure risks
- Build automated workflows that identify vulnerabilities
- Coordinate incident response and vulnerability triage
Must have
- Hands-on experience in application and infrastructure security
- Experience with code review and threat modeling
- Experience securing cloud-native environments
Nice to have
- Experience with automated security controls in CI/CD pipelines
- Understanding of containerized and distributed environments
- Comfortable managing vulnerability management programs
Practical constraints
- Hybrid model with three days per week on-site
AI in the day-to-day
Embracing the usefulness of generative AI tools and applying them to daily work.
Not disclosed in this posting: compensation, years of experience, visa sponsorship.
Joblaze summary
In this role, the Senior Security Engineer II at Strava focuses on safeguarding the platform by ensuring the security and compliance of applications and infrastructure. Key skills include hands-on experience with application security, vulnerability management, and automated security controls, particularly in cloud environments like AWS. This position is ideal for someone with a strong technical background who can collaborate effectively with engineering teams to implement secure practices. The role is part of a proactive security team dedicated to protecting millions of athletes worldwide.
Joblaze insights
Quick facts
- Is the Senior Security Engineer II role remote?
- It's hybrid — Strava expects some on-site time in San Francisco, California, United States.
- Where is the role based?
- Strava is hiring for this position in San Francisco, California, United States.
- What's the tech stack?
- Joblaze extracted these technologies from the posting: AWS, CI/CD, Kubernetes, Semgrep, Snyk, Trivy.
- What seniority level is this role?
- Strava targets senior candidates for this position.
- Is this full-time or contract?
- Full-time for this Senior Security Engineer II role at Strava.
From the original posting
This role is on the Strava Security Team, which exists to protect Strava’s people, business, and data through integrated, proactive security practices.
We work across all security domains, including, but not limited to, product security, vulnerability management, incident response, infrastructure, network, and enterprise security.
We follow a flexible hybrid model that generally translates to around half your time on-site in our San Francisco office – three days per week.
What You’ll Do:
Protect a platform that supports millions of athletes by ensuring Strava’s applications and infrastructure are secure, resilient, and compliant across regions.
Work closely with engineering, infrastructure, and security teams to design and implement secure architectures and development practices.
Make a high-leverage impact by shaping how Strava manages application and infrastructure risks in the US and EU, ensuring speed, accuracy, and consistency in remediation.
Build automated workflows that identify vulnerabilities early, enforce secure configurations, and strengthen our CI/CD and cloud security controls.
You Will Be Successful Here By:
Being highly self-motivated and detail-oriented, with a strong sense of ownership for Strava’s application, infrastructure, and network security posture.
Driving secure-by-design practices across engineering teams, including threat modeling, architecture reviews, and vulnerability management.
Embracing the usefulness of generative AI tools and applying them to your daily work.
Partnering with Engineering and Infrastructure teams to embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments.
Coordinating incident response, vulnerability triage, and remediation validation in partnership with the global security team.
What You’ll Bring to the Team:
Bring hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments (AWS preferred).
Have designed or implemented automated security controls in CI/CD pipelines using tools like GHAS, Snyk, Semgrep, Trivy, etc.
Understand how to secure containerized and distributed environments, including Kubernetes, IAM, and network segmentation.
Are comfortable managing vulnerability management programs end-to-end, from detection and prioritization through engineering remediation.
Are collaborative and pragmatic — able to influence engineering teams through partnership, technical credibility, and clear communication.
For information on benefits, please click here.
Why Join Us?
Standard company text repeated across Strava's postings is omitted here.