SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Strava is seeking a Senior Manager of Detection & Response to lead and scale the security operations function within the company's Security team. Reporting to the CISO, you will own strategy and execution for security monitoring, incident response, recovery, and post-incident improvement across both corporate infrastructure and the Strava product platform serving over 200 million athletes globally.
Key responsibilities include leading incident response as the senior escalation point and incident commander during active investigations; building and maturing detection engineering across cloud, endpoint, and application layers; owning the security logging and telemetry pipeline to ensure proper data collection, normalization, and usability; and shaping the operating model by deciding what to build in-house versus deliver through managed services and strategic vendors.
You will modernize the Security Operations Center (SOC) through automation and AI to increase coverage and response speed, manage incident playbooks and on-call escalation paths, deliver executive-ready reporting on incident trends and program maturity, and build and coach a small team of detection and response engineers. The role requires applying threat intelligence and adversary tradecraft knowledge to drive proactive detection and threat hunting.
You bring deep technical credibility with a proven track record building or scaling detection engineering or security operations programs. You have sound understanding of modern adversary tradecraft and experience translating threat intelligence into practical detection strategies. You've successfully led incident command for complex security incidents involving multiple stakeholders from working teams to executive leadership. You're comfortable extending lean team coverage through managed services and vendors, with experience selecting partners and holding them accountable to measurable outcomes. You have familiarity with automation and AI/ML techniques applied to security operations, excellent problem-solving instincts, and the ability to operate with ambiguity while maintaining a steady presence during active incidents.
The role operates on a flexible hybrid model requiring more than half your time on-site in the San Francisco office, approximately three days per week.
