Senior Security Engineer: Secure Cloud & CI/CD

Strava; United States; On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

401(k) with company match

Professional development stipend

Genrous gear stipend

Stock options

On-site fitness

Job summary

Strava is seeking a collaborative security engineer to protect our platform in the US and EU, embedding automated security checks into CI/CD pipelines and IaC deployments. You will work with engineering to implement secure architectures, conduct threat modeling, and manage vulnerability programs across cloud-native environments.

Join a team that drives incident response, remediation validation, and secure configurations while partnering with Engineering and Infrastructure to strengthen Strava’s

Qualifications

• Experience securing containerized and distributed environments (Kubernetes, IAM, network segmentation).
• Hands-on vulnerability management across detection, prioritization, and remediation.
• Proven ability to review architecture and drive threat modeling with engineering teams.
• Experience implementing automated security controls in CI/CD pipelines.

Responsibilities

• Collaborate with Engineering and Infrastructure to embed automated security checks in CI/CD and IaC deployments.
• Lead incident response coordination, vulnerability triage, and remediation validation.
• Shape secure-by-design practices across product and platform teams, with a focus on US and EU regions.

Skills

Threat modeling

Architecture reviews

Vulnerability management

CI/CD security

Cloud security

Kubernetes

IAM

Network segmentation

Tools

GHAS

Snyk

Semgrep

Trivy

AWS

Job description

Strava is seeking a collaborative security engineer to protect our platform in the US and EU, embedding automated security checks into CI/CD pipelines and IaC deployments. You will work with engineering to implement secure architectures, conduct threat modeling, and manage vulnerability programs across cloud-native environments.

Join a team that drives incident response, remediation validation, and secure configurations while partnering with Engineering and Infrastructure to strengthen Strava’s