24 days ago
Base Salary
$230k - $250k/yr
Responsibilities
- Secure Strava’s applications, infrastructure, and data across regions.
- Design and implement secure architectures and development practices with engineering, infrastructure, and security teams.
- Shape application and infrastructure risk management and remediation practices across the US and EU.
- Build automated workflows for vulnerability detection, secure configuration enforcement, and cloud security controls.
- Drive secure-by-design practices through threat modeling, architecture reviews, and vulnerability management.
- Embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments.
- Coordinate incident response, vulnerability triage, and remediation validation with the global security team.
Requirements
- Hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments; AWS experience is preferred.
- Experience designing or implementing automated security controls in CI/CD pipelines using tools such as GHAS, Snyk, Semgrep, or Trivy.
- Understanding of securing containerized and distributed environments, including Kubernetes, IAM, and network segmentation.
- Experience managing vulnerability management programs from detection and prioritization through engineering remediation.
- Ability to collaborate with and influence engineering teams through technical credibility, partnership, and clear communication.
- Self-motivated, detail-oriented, pragmatic, and able to take ownership of application, infrastructure, and network security posture.
- Comfort using generative AI tools in daily work.
Benefits
- Flexible hybrid work model with approximately three days per week onsite at the San Francisco office.
- Employee benefits are provided through the linked Strava benefits document.
Tech Stack
Categories
About Strava
Strava builds a fitness-tracking and social platform for runners, cyclists, and other athletes on iOS, Android, and the web. The company operates a freemium subscription business with paid training, routing, and safety features, plus APIs and Strava for Business partnerships. Founded in 2009 and headquartered in San Francisco, it is privately held and used by over 200 million athletes across more than 185 countries.