24 hours ago
Base Salary
$230k - $250k/yr
Responsibilities
- Protect Strava’s applications and infrastructure by improving security, resilience, and compliance across regions.
- Design and implement secure architectures and development practices with engineering, infrastructure, and security teams.
- Build automated workflows for vulnerability detection, secure configuration enforcement, and cloud security controls.
- Drive threat modeling, architecture reviews, vulnerability management, and secure-by-design practices across engineering teams.
- Embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments.
- Coordinate incident response, vulnerability triage, remediation, and remediation validation with the global security team.
Requirements
- Hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments; AWS experience is preferred.
- Experience designing or implementing automated security controls in CI/CD pipelines using tools such as GHAS, Snyk, Semgrep, or Trivy.
- Understanding of securing containerized and distributed environments, including Kubernetes, IAM, and network segmentation.
- Experience managing vulnerability management programs from detection and prioritization through engineering remediation.
- Ability to collaborate with and influence engineering teams through technical credibility, pragmatism, and clear communication.
- Strong ownership, self-motivation, and attention to detail.
Benefits
- Flexible hybrid work model, generally involving three days per week on-site in Strava’s San Francisco office.
- Benefits information is provided through a linked document.
Tech Stack
Categories
About Strava
Strava builds a fitness-tracking and social platform for runners, cyclists, and other athletes on iOS, Android, and the web. The company operates a freemium subscription business with paid training, routing, and safety features, plus APIs and Strava for Business partnerships. Founded in 2009 and headquartered in San Francisco, it is privately held and used by over 200 million athletes across more than 185 countries.