Senior Security Engineer II — Secure-by-Design & Cloud Security

Strava; San Francisco (CA); Hybrid; USD 150,000 - 210,000; Full time

Job summary

Strava is seeking a security engineer on the Security Team to protect our platform and data. You will work with engineering, infrastructure, and security partners to design secure architectures, embed automated security checks in CI/CD, and strengthen cloud security across regions.

You’ll drive threat modeling, vulnerability triage, and remediation validation, collaborating with global teams, and applying secure-by-design practices to containerized and distributed environments including AWS and

Qualifications

• Experience in application and infrastructure security, including secure architectures and threat modeling.
• Ability to embed automated security checks into CI/CD pipelines and IaC deployments.
• Experience securing cloud-native environments (AWS preferred) and containerized workloads.

Responsibilities

• Protect a platform that supports millions of athletes by ensuring Strava’s applications and infrastructure are secure, resilient, and compliant across regions.
• Work with Engineering, Infrastructure, and Security teams to design and implement secure architectures and development practices.
• Shape how Strava manages application and infrastructure risks in the US and EU with rapid remediation.
• Build automated workflows that identify vulnerabilities early and strengthen cloud security controls.

Skills

Application security

Infrastructure security

Threat modeling

Cloud security (AWS)

CI/CD security

Kubernetes security

Collaboration

Tools

GHAS

Snyk

Semgrep

Trivy

Kubernetes

IAM

Job description

Strava is seeking a security engineer on the Security Team to protect our platform and data. You will work with engineering, infrastructure, and security partners to design secure architectures, embed automated security checks in CI/CD, and strengthen cloud security across regions.

You’ll drive threat modeling, vulnerability triage, and remediation validation, collaborating with global teams, and applying secure-by-design practices to containerized and distributed environments including AWS and