Senior Manager of Cybersecurity Strategy & Risk, Strava
$270-290k
+ equity
3 days a week in office (Strava, CA)
Social network for tracking run & cycle routes
Be an early applicant
Social network for tracking run & cycle routes
501-1000 employees
Be an early applicant
$270-290k
+ equity
3 days a week in office (Strava, CA)
501-1000 employees
Company mission
To create the most committed, close, and engaged athlete community on the internet.
Role
Who you are
- Bachelor's degree in Engineering, Cybersecurity or related field
- 8-12 years of experience in security, cyber risk, technical security assurance or related technical risk roles
- Security certifications e.g. CISSP, CISM, or other relevant certifications
- Demonstrated success of standing up and managing security risk programs, treatment decisions and cross-functional execution end to end
- Strong understanding of security controls and how to work with engineering on implementation details
- Demonstrated track record translating technical security or threat findings into clear risk narratives
- Hands-on technical fluency: you've personally read and interpreted threat models, vulnerability findings, or incident data, not just relayed summaries of them
- Demonstrated experience using AI or automation tools to directly improve technical security or risk workflows (e.g., automating vulnerability triage, control testing, or risk scoring)
- Experience handling ambiguity, driving accountability and working across multiple stakeholders
- Excellent written and verbal communication skills, including ability to prepare and present risk reports to technical teams, senior leadership and board level executives
- Experience managing and developing teams
- Experience scaling GRC processes in a high-growth or consumer tech company is a plus
- Third-party or vendor risk management experience is a plus
- Quantitative risk methodology experience (e.g., FAIR) is a plus
What the job involves
- Strava's Cybersecurity team protects the trust of a global community of athletes who rely on our platform every day. As the team scales its security program, we're rethinking how we assess and act on security risk: moving away from static, point-in-time risk registers and toward a living, data-driven view of where our real exposure lies
- This is a role with a 70/30 split between hands-on execution and people management, reporting directly to the CISO. You'll build this function largely from scratch, standing up a repeatable process that turns various risk signals into a single, prioritized view that executive stakeholders can act on. You'll partner closely with cross-functional stakeholders across the business
- Own and advance Strava's security governance, strategy and risk management programs, leading a small team to help execute them
- Build a repeatable process that turns risk signals (threat models, bugs, vulnerabilities, incidents, vendor assessments) into one prioritized risk view with defined risk acceptance thresholds and escalation paths
- Own the AI and third-party risk management process — delivering risk insights that matter, not rubber-stamping compliance
- Establish a security steering committee with relevant stakeholders to ensure alignment on risk tolerance and prioritization
- Establish a multi-year, actionable security strategy, roadmap and investment priorities
- Deliver regular, executive- and board-ready risk reporting
- Partner across Engineering, Trust & Safety, Legal, AI Enablement, and other business functions, representing security in cross-functional planning and risk reviews
- Identify and implement opportunities to use AI and automation to improve efficiency of risk workflows
- Continuously evolve the risk methodology as new data sources, attack patterns, and business priorities emerge
Our take
Strava has created an online network where runners, swimmers and cyclists can record fitness activities, and compare and compete with their community. It offers both a free and premium subscription service, and also partners with local councils and urban planners who purchase its journey data to map out cities and develop safer cycle paths.
With over 125 million athletes and growing, Strava's popularity is clear. Over the years, it has released new features such as an AI-enabled leaderboard, as well as partnering with Oura to make its software available through Oura's wearables. It has also secured impressive funding and a valuation over $2 billion, and is now pursuing an IPO.
Freddie
Company Specialist at Welcome to the Jungle
Insights
-6% employee growth in 12 months
Company
Funding (last 2 of 5 rounds)
Nov 2020
$110m
SERIES F
Oct 2014
$18m
LATE VC
Total funding: $151.4m
Company benefits
- Stock options
- 100% company paid benefits for employees and families
- Flexible paid time off
- $2,000 annual professional development stipend
- Paid time off for volunteering
- 401(k) plan - with company matching
- $1000 annual gear stipend
- $500 annual gym or coaching reimbursement
- On-site fitness rooms with showers, lockers, and towel service
- Weekly team workouts – including remote employees
- Safe and secure bike storage on-site
- Weekly all hands meetings
- Employee resource groups
- Anti-racism nonprofit company matching program
- Free lunch on Wednesdays on-site
- Regular team happy hours
- Team offsites and company retreats
- Cell phone reimbursement
- Generous industry discounts on gear and activities
- Race entries to events we sponsor
- Snacks and stocked kitchens on-site
- Strava gear
Company HQ
Mission District, San Francisco, CA
Leadership
Michael Martin
(CEO & Board Member)Previously GM/VP at YouTube, GM/VP (Greater China Marketplace) at Nike, SVP (Product & Engineering) at NBCUniversal Media and VP (Engineering) at Disney ABC Television Group.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 26 more jobs at Strava