Strava is the app for active people, with over 200 million athletes in more than 185 countries
The Strava Security Team protects Strava's people, business, and data through integrated, proactive security practices
Works across product security, vulnerability management, incident response, infrastructure, network, and enterprise security
Responsibilities
Protect a platform that supports millions of athletes by ensuring applications and infrastructure are secure, resilient, and compliant across regions
Work closely with engineering, infrastructure, and security teams to design and implement secure architectures and development practices
Shape how Strava manages application and infrastructure risks in the US and EU
Build automated workflows that identify vulnerabilities early, enforce secure configurations, and strengthen CI/CD and cloud security controls
Drive secure-by-design practices across engineering teams, including threat modeling, architecture reviews, and vulnerability management
Partner with Engineering and Infrastructure teams to embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments
Coordinate incident response, vulnerability triage, and remediation validation in partnership with the global security team
Requirements
Hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments (AWS preferred)
Designed or implemented automated security controls in CI/CD pipelines using tools like GHAS, Snyk, Semgrep, Trivy
Understand how to secure containerized and distributed environments, including Kubernetes, IAM, and network segmentation