Senior Security Engineer II

Strava powers an app used by active people worldwide, with 200+ million athletes across 185+ countries. In this hybrid role in San Francisco, you’ll join the Strava Security Team to help secure applications and infrastructure across regions while driving proactive, automated risk reduction.

You’ll focus on secure architecture, vulnerability management, and strengthening CI/CD and cloud security controls in the US and EU, with a goal of remediation that is fast, accurate, and consistent.

What you’ll do

• Protect a platform used by millions of athletes by ensuring Strava’s applications and infrastructure are secure, resilient, and compliant across regions.
• Partner with engineering, infrastructure, and security teams to design and implement secure architectures and development practices.
• Shape how Strava manages application and infrastructure risks in the US and EU, improving speed, accuracy, and consistency of remediation.
• Build automated workflows to identify vulnerabilities early, enforce secure configurations, and strengthen CI/CD and cloud security controls.
• Coordinate incident response, vulnerability triage, and remediation validation alongside the global security team.

What you bring

• Strong self-motivation and attention to detail, with ownership for Strava’s application, infrastructure, and network security posture.
• Ability to drive secure-by-design practices across engineering teams, including threat modeling, architecture reviews, and vulnerability management.
• Comfort using generative AI tools as part of daily work.
• Experience partnering with engineering and infrastructure teams to embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments.
• Hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments (AWS preferred).
• Experience designing or implementing automated security controls in CI/CD using tools such as GHAS, Snyk, Semgrep, Trivy, and similar solutions.
• Understanding of securing containerized and distributed environments, including Kubernetes, IAM, and network segmentation.
• Ability to manage vulnerability management end-to-end, from detection and prioritization through engineering remediation.
• Collaborative, pragmatic communication skills, with the ability to influence teams through technical credibility and clear messaging.

Technologies

• AWS
• GHAS
• Snyk
• Semgrep
• Trivy
• Kubernetes
• IAM
• CI/CD
• Infrastructure-as-code
• Generative AI

Role details

• Location: San Francisco, CA (Hybrid)
• Employment type: Full time
• Department: TechnologySecurity
• Salary: USD 230,000 - 250,000 per year
• Equity: Offers Equity
• Note on compensation: This range reflects base compensation only and does not include equity or benefits. Your recruiter can share more details about the full compensation package during the hiring process.