Senior Security Engineer II
Senior
Application Security
Ci/cd Security
Cloud Platforms
Cloud Security
Container Security
Cybersecurity Operations
Data Security
Engineer
Generative Ai Security
Identity and Access Management
Incident Management
Incident Response
Information Security
Information Technology (IT)
InfoSec
Product Security
Risk Governance
Risk Management
Security
Security Automation
Security Compliance
Security Operations
Security Standards
Security Testing
Software Security
Vulnerability Management
Job Description
Senior Security Engineer II role on Strava’s Security Team in San Francisco (hybrid) focused on securing applications and infrastructure across regions with proactive, automated risk reduction.
Responsibilities
- Help protect a platform used by millions of athletes by ensuring Strava applications and infrastructure are secure, resilient, and compliant across regions.
- Partner with Engineering, Infrastructure, and Security teams to design and implement secure architectures and development practices.
- Drive high-leverage improvements to how application and infrastructure risks are managed in the US and EU, with remediation that is fast, accurate, and consistent.
- Build automated workflows to identify vulnerabilities early, enforce secure configurations, and strengthen CI/CD and cloud security controls.
- Coordinate with the global security team on incident response, vulnerability triage, and remediation validation.
Requirements
- Highly self-motivated and detail-oriented, with strong ownership of Strava’s application, infrastructure, and network security posture.
- Ability to drive secure-by-design practices across engineering teams, including threat modeling, architecture reviews, and vulnerability management.
- Comfort applying generative AI tools to daily work.
- Partner effectively with Engineering and Infrastructure to embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments.
- Hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments (AWS preferred).
- Experience designing or implementing automated security controls in CI/CD pipelines using tools such as GHAS, Snyk, Semgrep, Trivy, etc.
- Understand securing containerized and distributed environments, including Kubernetes, IAM, and network segmentation.
- Capability to run vulnerability management end-to-end, from detection and prioritization through engineering remediation.
- Collaborative and pragmatic approach, able to influence engineering teams through partnership, technical credibility, and clear communication.
Technologies
- AWS
- GHAS
- Snyk
- Semgrep
- Trivy
- Kubernetes
- IAM
- CI/CD
- Infrastructure-as-code
- Generative AI
Location
- San Francisco, CA (hybrid)
Employment Type
- Full time
Compensation
- USD 230,000 - 250,000 per year
- Offers equity
- Base compensation range only; excludes equity and benefits
- Recruiter can share details about the full compensation package during hiring
About Strava
- Strava is the app for active people.
- Over 200 million athletes in more than 185 countries.
- This role is on the Strava Security Team, which protects Strava’s people, business, and data through integrated, proactive security practices.
Similar Jobs
