SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Strava is a global community platform for active people with over 200 million athletes across 185+ countries. The Security Team protects Strava's people, business, and data through integrated, proactive security practices across all security domains including product security, vulnerability management, incident response, infrastructure, network, and enterprise security.
In this Senior Security Engineer II role, you will protect a platform serving millions of athletes by ensuring Strava's applications and infrastructure are secure, resilient, and compliant across regions. You'll work closely with engineering, infrastructure, and security teams to design and implement secure architectures and development practices. Your work will have high-leverage impact by shaping how Strava manages application and infrastructure risks in the US and EU, ensuring speed, accuracy, and consistency in remediation.
Key responsibilities include:
- Building automated workflows that identify vulnerabilities early, enforce secure configurations, and strengthen CI/CD and cloud security controls
- Driving secure-by-design practices across engineering teams through threat modeling, architecture reviews, and vulnerability management
- Partnering with Engineering and Infrastructure teams to embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments
- Coordinating incident response, vulnerability triage, and remediation validation in partnership with the global security team
- Managing vulnerability management programs end-to-end, from detection and prioritization through engineering remediation
You'll be highly self-motivated and detail-oriented with strong ownership of Strava's security posture. You'll influence engineering teams through partnership, technical credibility, and clear communication. The role follows a flexible hybrid model with approximately half your time on-site in the San Francisco office (three days per week).
REQUIREMENTS:
- Hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments (AWS preferred)
- Demonstrated experience designing or implementing automated security controls in CI/CD pipelines using tools such as GHAS, Snyk, Semgrep, Trivy, or similar
- Understanding of how to secure containerized and distributed environments, including Kubernetes, IAM, and network segmentation
- Ability to manage vulnerability management programs end-to-end, from detection and prioritization through engineering remediation
- Collaborative and pragmatic approach; ability to influence engineering teams through partnership, technical credibility, and clear communication
- Comfort embracing generative AI tools and applying them to daily work
