SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Strava is a global community platform for active people with over 200 million athletes in 185+ countries. The Cybersecurity team protects this community by securing the platform, data, and systems athletes depend on daily.
As a Staff Enterprise Security Engineer, you will set the technical direction for Enterprise Security and drive its execution across the organization. You will assess the current environment, define pragmatic target-state controls, and lead improvements across endpoints, device management, browsers, Google Workspace, critical SaaS applications, and corporate identity integrations. This is a hands-on technical leadership role where you partner closely with IAM, IT, Engineering, and Detection & Response teams to make architecture decisions that balance security, employee productivity, and developer velocity.
Key responsibilities include:
- Owning the technical strategy for Enterprise Security: assessing the current environment, defining target-state controls, and maintaining a risk-prioritized roadmap and backlog
- Hardening macOS and Windows endpoints across EDR, MDM, encryption, local administrator controls, host firewall, patching, and device compliance baselines; defining a practical security model for Linux in an engineering-heavy environment
- Improving device-management architecture and managed-browser controls, including enrollment, configuration profiles, compliance policies, extension governance, and authentication/session controls
- Hardening Google Workspace and critical SaaS applications (authentication, admin privileges, email, Drive sharing, context-aware access); establishing repeatable hardening approaches
- Leading OAuth and third-party application governance: reviewing existing grants, remediating risky scopes and integrations, and setting up ongoing approval and review processes
- Partnering with IAM to design and implement SSO, MFA, device trust, conditional access, privileged access, and lifecycle controls
- Building scripts, integrations, and automation to make controls repeatable and measurable, reducing manual security operations
- Advising IT, Engineering, and business partners on security design and tradeoffs; documenting architecture decisions, exceptions, and residual risk
- Partnering with Detection & Response on corporate security incidents, mentoring other engineers, and participating in business-hours on-call rotation
The role operates on a flexible hybrid model with more than half your time on-site in the San Francisco office (three days per week).
Requirements:
- Substantial experience in Enterprise Security, Security Engineering, or closely related corporate security roles, including independently owning initiatives from assessment and architecture through implementation and operationalization
- Deep hands-on experience securing macOS and Windows endpoints with modern EDR, MDM, device-compliance, and fleet-management tools (e.g., Jamf or Intune; equivalent technologies acceptable)
- Hands-on experience hardening Google Workspace and corporate SaaS environments, including admin controls, sharing, email, third-party integrations, and OAuth application governance
- Solid understanding of enterprise identity and access architecture, including SSO, MFA, device trust, conditional access, privileged access, identity lifecycle, and Zero Trust principles, with tools such as Okta, Chrome Enterprise, and ZTNA platforms
- Experience designing pragmatic controls for engineering-heavy environments (Linux systems, developer workflows, non-standard endpoints); ability to script and automate in Python or similar language and integrate systems through APIs
- Sound architectural judgment and clear written and verbal communication, including advising senior technical and business stakeholders and driving work across multiple teams in a distributed company
- Plus: Experience with SaaS Security Posture Management (SSPM), CASB, DLP, DSPM, or securing enterprise AI and productivity platforms
