Staff Enterprise Security Engineer

Strava•San Francisco, CA

5d•$270,000 - $290,000•Hybrid

About The Position

Strava’s Cybersecurity team protects the trust of its athletes by securing the platform, data, and systems the community depends on. Enterprise Security covers the corporate environment, including endpoints, identity, browsers, Google Workspace, and SaaS tools. The Staff Enterprise Security Engineer sets technical direction for Enterprise Security and drives its execution. The role assesses the current environment, defines pragmatic target-state controls, and leads improvements across endpoints, device management, browsers, Google Workspace, critical SaaS, and corporate identity integrations. The engineer partners with IAM, IT, Engineering, and Detection & Response, making architecture decisions that balance security, employee productivity, and developer velocity. The position follows a flexible hybrid model, with more than half of working time on-site at Strava’s San Francisco office, three days per week.

Requirements

Substantial experience in Enterprise Security, Security Engineering, or closely related corporate security roles, including independently owning initiatives from assessment and architecture through implementation and operationalization.
Deep hands-on experience securing macOS and Windows endpoints using modern EDR, MDM, device-compliance, and fleet-management tools; Jamf or Intune are examples, and equivalent technologies are acceptable.
Hands-on experience hardening Google Workspace and corporate SaaS environments, including admin controls, sharing, email, third-party integrations, and OAuth application governance.
Solid understanding of enterprise identity and access architecture, including SSO, MFA, device trust, conditional access, privileged access, identity lifecycle, and Zero Trust principles.
Experience designing pragmatic controls for engineering-heavy environments, including Linux systems, developer workflows, and non-standard endpoints.
Ability to script and automate in Python or a similar language and integrate systems through APIs.
Sound architectural judgment and clear written and verbal communication, including advising senior technical and business stakeholders and driving work across multiple teams in a distributed company.

Nice To Haves

Experience with SaaS Security Posture Management (SSPM), CASB, DLP, DSPM, or securing enterprise AI and productivity platforms.
Experience with tools such as Okta, Chrome Enterprise, and ZTNA platforms.

Responsibilities

Own Enterprise Security technical strategy, assess the current environment, define target-state controls, and maintain a risk-prioritized roadmap and backlog.
Harden macOS and Windows endpoints across EDR, MDM, encryption, local administrator controls, host firewall, patching, and device-compliance baselines; define a practical security model for Linux in an engineering-heavy environment.
Improve device-management architecture and managed-browser controls, including enrollment, configuration profiles, compliance policies, extension governance, authentication, and session controls integrated with identity and access policy.
Harden Google Workspace and critical SaaS applications, including authentication, admin privileges, email, Drive sharing, and context-aware access; establish a repeatable hardening approach and remediate high-risk gaps.
Lead OAuth and third-party application governance by reviewing existing grants, addressing risky scopes and integrations, and establishing ongoing approval and review processes.
Partner with IAM to design and implement SSO, MFA, device trust, conditional access, privileged access, and lifecycle controls.
Build scripts, integrations, and automation to make controls repeatable and measurable and reduce manual security operations.
Advise IT, Engineering, and business partners on security design and tradeoffs; turn ambiguous problems into concrete plans; document architecture decisions, exceptions, and residual risk.
Partner with Detection & Response on corporate security incidents.
Mentor other engineers.
Participate in a business-hours on-call rotation with clear handoffs across time zones.