> Markdown version of [/jobs/ext/4285318-staff-enterprise-security-engineer](https://www.wearedevelopers.com/jobs/ext/4285318-staff-enterprise-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Staff Enterprise Security Engineer

- **Company:** Strava
- **Location:** San Francisco, CA, United States
- **Salary:** $270,000 - $290,000
- **Contract:** Permanent contract
- **Skills:** Microsoft Access, Microsoft Windows, Application Programming Interfaces (APIs), Artificial Intelligence, Apple Mac Systems, Software as a Service, Cloud Computing Security, Cyber Security, Linux, Identity and Access Management, Information Security Management, Python (Programming Language), OAuth, Zero Trust Network Access, Systems Integration, Okta, Microsoft InTune, Integration Frameworks, Casper Suite, Gsuite
- **Published:** October 19, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=70370a699ddbb120

## About the Role

* Substantial experience in Enterprise Security, Security Engineering, or closely related corporate security roles, including independently owning initiatives from assessment and architecture through implementation and operationalization.
 * Deep hands-on experience securing macOS and Windows endpoints with modern EDR, MDM, device-compliance, and fleet-management tools (for example Jamf or Intune; equivalent technologies are fine).
 * Hands-on experience hardening Google Workspace and corporate SaaS environments, including admin controls, sharing, email, third-party integrations, and OAuth application governance.
 * Solid understanding of enterprise identity and access architecture, including SSO, MFA, device trust, conditional access, privileged access, identity lifecycle, and Zero Trust principles, with tools such as Okta, Chrome Enterprise, and ZTNA platforms.
 * Experience designing pragmatic controls for engineering-heavy environments (Linux systems, developer workflows, non-standard endpoints), and the ability to script and automate in Python or a similar language and integrate systems through APIs.
 * Sound architectural judgment and clear written and verbal communication, including advising senior technical and business stakeholders and driving work across multiple teams in a distributed company.
 * Experience with SaaS Security Posture Management (SSPM), CASB, DLP, DSPM, or securing enterprise AI and productivity platforms is a plus.

## Description

* Own the technical strategy for Enterprise Security: assess the current environment, define target-state controls, and maintain a risk-prioritized roadmap and backlog.
 * Harden macOS and Windows endpoints across EDR, MDM, encryption, local administrator controls, host firewall, patching, and device compliance baselines, and define a practical security model for Linux in an engineering-heavy environment.
 * Improve device-management architecture and managed-browser controls, including enrollment, configuration profiles, compliance policies, extension governance, and authentication and session controls, with tight integration into identity and access policy.
 * Harden Google Workspace and critical SaaS applications (authentication, admin privileges, email, Drive sharing, context-aware access), establish a repeatable hardening approach, and drive remediation of the highest-risk gaps.
 * Lead OAuth and third-party application governance: review existing grants, remediate risky scopes and integrations, and set up an ongoing approval and review process.
 * Partner with IAM to design and implement SSO, MFA, device trust, conditional access, privileged access, and lifecycle controls.
 * Build scripts, integrations, and automation that make controls repeatable and measurable, and reduce manual security operations.
 * Advise IT, Engineering, and business partners on security design and tradeoffs, turning ambiguous problems into concrete plans, and document architecture decisions, exceptions, and residual risk.
 * Partner with Detection & Response on corporate security incidents, mentor other engineers, and take part in a business-hours on-call rotation with clear handoffs across time zones.