Senior Security Engineer II

📋 Job Overview

This role is on the Strava Security Team, which exists to protect Strava’s people, business, and data through integrated, proactive security practices. We work across all security domains, including, but not limited to, product security, vulnerability management, incident response, infrastructure, network, and enterprise security. We follow a flexible hybrid model that generally translates to around half your time on-site in our San Francisco office – three days per week.

🏢 About Strava

Strava is the app for active people. With over 200 million athletes in more than 185 countries, it’s more than tracking workouts—it’s where people make progress together, from new habits to new personal bests. No matter your sport or how you track it, Strava’s got you covered. Find your crew, crush your goals, and make every effort count. Start your journey with Strava today. Our mission is simple: to motivate people to live their best active lives. We believe in the power of movement to connect and drive people forward.

🎯 The Role

Protect a platform that supports millions of athletes by ensuring Strava’s applications and infrastructure are secure, resilient, and compliant across regions. Work closely with engineering, infrastructure, and security teams to design and implement secure architectures and development practices. Make a high-leverage impact by shaping how Strava manages application and infrastructure risks in the US and EU, ensuring speed, accuracy, and consistency in remediation. Build automated workflows that identify vulnerabilities early, enforce secure configurations, and strengthen our CI/CD and cloud security controls.

✅ Key Responsibilities

• Protect a platform that supports millions of athletes by ensuring Strava’s applications and infrastructure are secure, resilient, and compliant across regions.
• Work closely with engineering, infrastructure, and security teams to design and implement secure architectures and development practices.
• Make a high-leverage impact by shaping how Strava manages application and infrastructure risks in the US and EU, ensuring speed, accuracy, and consistency in remediation.
• Build automated workflows that identify vulnerabilities early, enforce secure configurations, and strengthen our CI/CD and cloud security controls.

📌 Required Qualifications

• Hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments (AWS preferred).
• Designed or implemented automated security controls in CI/CD pipelines using tools like GHAS, Snyk, Semgrep, Trivy, etc.
• Understanding of how to secure containerized and distributed environments, including Kubernetes, IAM, and network segmentation.
• Comfortable managing vulnerability management programs end-to-end, from detection and prioritization through engineering remediation.
• Collaborative and pragmatic — able to influence engineering teams through partnership, technical credibility, and clear communication.

🎁 Benefits

Compensation: $230K – $250K • Offers Equity

🛂 Visa & Eligibility

Strava is an equal opportunity employer. In keeping with the values of Strava, we make all employment decisions including hiring, evaluation, termination, promotional and training opportunities, without regard to race, religion, color, sex, age, national origin, ancestry, sexual orientation, physical handicap, mental disability, medical condition, disability, gender or identity or expression, pregnancy or pregnancy-related condition, marital status, height and/or weight. We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment.