Senior Security Engineer

Strava; United States; On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

401(k) with company match

Professional development stipend

Genrous gear stipend

Stock options

On-site fitness

Job summary

Strava is seeking a collaborative security engineer to protect our platform in the US and EU, embedding automated security checks into CI/CD pipelines and IaC deployments. You will work with engineering to implement secure architectures, conduct threat modeling, and manage vulnerability programs across cloud-native environments.

Join a team that drives incident response, remediation validation, and secure configurations while partnering with Engineering and Infrastructure to strengthen Strava’s

Qualifications

• Experience securing containerized and distributed environments (Kubernetes, IAM, network segmentation).
• Hands-on vulnerability management across detection, prioritization, and remediation.
• Proven ability to review architecture and drive threat modeling with engineering teams.
• Experience implementing automated security controls in CI/CD pipelines.

Responsibilities

• Collaborate with Engineering and Infrastructure to embed automated security checks in CI/CD and IaC deployments.
• Lead incident response coordination, vulnerability triage, and remediation validation.
• Shape secure-by-design practices across product and platform teams, with a focus on US and EU regions.

Skills

Threat modeling

Architecture reviews

Vulnerability management

CI/CD security

Cloud security

Kubernetes

IAM

Network segmentation

Tools

GHAS

Snyk

Semgrep

Trivy

AWS

Job description

• This role is on the Strava Security Team, which exists to protect Strava’s people, business, and data through integrated, proactive security practices
• We work across all security domains, including, but not limited to, product security, vulnerability management, incident response, infrastructure, network, and enterprise security
• Protect a platform that supports millions of athletes by ensuring Strava’s applications and infrastructure are secure, resilient, and compliant across regions
• Work closely with engineering, infrastructure, and security teams to design and implement secure architectures and development practices
• Make a high-leverage impact by shaping how Strava manages application and infrastructure risks in the US and EU, ensuring speed, accuracy, and consistency in remediation
• Build automated workflows that identify vulnerabilities early, enforce secure configurations, and strengthen our CI/CD and cloud security controls
• You Will Be Successful Here By:
• Being highly self-motivated and detail-oriented, with a strong sense of ownership for Strava’s application, infrastructure, and network security posture
• Driving secure-by-design practices across engineering teams, including threat modeling, architecture reviews, and vulnerability management
• Embracing the usefulness of generative AI tools and applying them to your daily work
• Partnering with Engineering and Infrastructure teams to embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments
• Coordinating incident response, vulnerability triage, and remediation validation in partnership with the global security team

Benefits

• 100% company paid benefits for employees and families
• Flexible paid time off
• $2,000 annual professional development stipend
• Paid time off for volunteering
• 401(k) plan - with company matching
• $1000 annual gear stipend
• $500 annual gym or coaching reimbursement
• On-site fitness rooms with showers, lockers, and towel service
• Weekly team workouts – including remote employees
• Safe and secure bike storage on-site
• Weekly all hands meetings
• Employee resource groups
• Anti-racism nonprofit company matching program
• Free lunch on Wednesdays on-site
• Regular team happy hours
• Team offsites and company retreats
• Cell phone reimbursement
• Generous industry discounts on gear and activities
• Race entries to events we sponsor
• Snacks and stocked kitchens on-site
• Strava gear
• Stock options

Are collaborative and pragmatic — able to influence engineering teams through partnership, technical credibility, and clear communicationUnderstand how to secure containerized and distributed environments, including Kubernetes, IAM, and network segmentationAre comfortable managing vulnerability management programs end-to-end, from detection and prioritization through engineering remediationBring hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments (AWS preferred)Have designed or implemented automated security controls in CI/CD pipelines using tools like GHAS, Snyk, Semgrep, Trivy, etc