Senior Security Engineer II
Strava · Strava SF
About the role
A senior engineer on Strava's Security team, which covers product, infrastructure, network and enterprise security along with vulnerability management and incident response. The focus is application and infrastructure security: shaping how risks are handled across US and EU operations, running threat modelling and architecture reviews, adding automated security gates to build pipelines and infrastructure-as-code deployments, and coordinating vulnerability triage, remediation checks and incident response with the global team.
Strava wants hands-on AppSec and cloud security experience, ideally on AWS, including code review, pipeline tooling such as GHAS, Snyk, Semgrep or Trivy, and securing Kubernetes and IAM, plus experience running a vulnerability program end to end. Daily use of generative AI tools is expected. Hybrid, three days a week in San Francisco.