Strava Senior Security Engineer II at Strava responsible for securing applications and infrastructure supporting millions of athletes. Design and implement secure architectures and automated security workflows.
Responsibilities
Protect a platform that supports millions of athletes by ensuring Strava’s applications and infrastructure are secure, resilient, and compliant across regions.
Work closely with engineering, infrastructure, and security teams to design and implement secure architectures and development practices.
Make a high-leverage impact by shaping how Strava manages application and infrastructure risks in the US and EU, ensuring speed, accuracy, and consistency in remediation.
Build automated workflows that identify vulnerabilities early, enforce secure configurations, and strengthen our CI/CD and cloud security controls.
Being highly self-motivated and detail-oriented, with a strong sense of ownership for Strava’s application, infrastructure, and network security posture.
Driving secure-by-design practices across engineering teams, including threat modeling, architecture reviews, and vulnerability management.
Embracing the usefulness of generative AI tools and applying them to your daily work.
Partnering with Engineering and Infrastructure teams to embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments.
Coordinating incident response, vulnerability triage, and remediation validation in partnership with the global security team.
What You’ll Bring to the Team:
Bring hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments (AWS preferred).
Have designed or implemented automated security controls in CI/CD pipelines using tools like GHAS, Snyk, Semgrep, Trivy, etc.
Qualification
Required
Hands-on experience in application and infrastructure security
