Senior Security Engineer II

Strava • San Francisco, CA

25d • $230,000 - $250,000 • Hybrid

About The Position

The Senior Security Engineer II will join Strava’s Security Team, which protects the company’s people, business, and data through integrated, proactive security practices. The team works across product security, vulnerability management, incident response, infrastructure, network, and enterprise security. This role helps secure Strava’s applications and infrastructure and supports a platform used by athletes around the world.

The engineer will work closely with engineering, infrastructure, and security teams to design secure architectures and development practices, manage application and infrastructure risks in the US and EU, and improve the speed, accuracy, and consistency of remediation. The role also builds automated workflows to identify vulnerabilities early, enforce secure configurations, and strengthen CI/CD and cloud security controls.

Strava uses a flexible hybrid model that generally means spending around half of working time on-site at its San Francisco office, three days per week.

Requirements

• Hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments.
• Experience designing or implementing automated security controls in CI/CD pipelines.
• Understanding of security for containerized and distributed environments, including Kubernetes, IAM, and network segmentation.
• Ability to manage vulnerability management programs end-to-end, from detection and prioritization through engineering remediation.
• Collaborative and pragmatic approach, with the ability to influence engineering teams through partnership, technical credibility, and clear communication.
• Self-motivated, detail-oriented, and able to take ownership of application, infrastructure, and network security posture.

Nice To Haves

• Experience securing cloud-native environments on AWS.
• Familiarity with CI/CD security tools such as GHAS, Snyk, Semgrep, or Trivy.
• Embracing generative AI tools and applying them to daily work.

Responsibilities

• Protect Strava’s applications and infrastructure by helping ensure they are secure, resilient, and compliant across regions.
• Work with engineering, infrastructure, and security teams to design and implement secure architectures and development practices.
• Shape how Strava manages application and infrastructure risks in the US and EU, supporting timely and consistent remediation.
• Build automated workflows to identify vulnerabilities early, enforce secure configurations, and strengthen CI/CD and cloud security controls.
• Drive secure-by-design practices across engineering teams, including threat modeling, architecture reviews, and vulnerability management.
• Embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments in partnership with Engineering and Infrastructure teams.
• Coordinate incident response, vulnerability triage, and remediation validation with the global security team.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed