Sr. Application Security Engineer

Hims & Hers•,

2d•$135,000 - $165,000•Remote

About The Position

Hims & Hers is seeking a Senior Application Security Engineer to join its security team. The role focuses on securing applications throughout the development lifecycle, applying modern security practices, partnering with development teams on secure coding, and maintaining the application security posture. The position is remote. The company follows NIST CSF, NIST 800-53, SOC 2, and PCI DSS compliance frameworks.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field.
5–8 years of experience in application security or a related security field.
Hands-on coding experience and the ability to review code in multiple languages.
Professional experience with SAST tools, such as GHAS.
Professional experience with DAST tools, such as Burp Suite or OWASP ZAP.
Professional experience with SCA tools, such as GHAS, Black Duck, or WhiteSource.
Experience with GitHub Advanced Security features.
Strong understanding of the OWASP Top 10 and secure coding practices.
Excellent communication skills to explain security findings to technical and non-technical stakeholders.
Ability to balance security requirements with business needs.
Strong collaboration skills, including working effectively with development teams.
Self-motivation and ability to manage multiple security assessments simultaneously.
Proficiency in reviewing Python, JavaScript, Java, Go, and other modern languages.
Development skills in languages such as JavaScript and TypeScript, and familiarity with Git.
Experience with Jenkins, GitHub Actions, or similar CI/CD tools.

Nice To Haves

Cloudflare WAF and Bot Management configuration experience.
Security automation and scripting experience with Python, Go, or similar languages.
Contributions to the security community, such as research, tools, or presentations.
Experience in healthcare or regulated industries.
AWS experience; multi-cloud experience is beneficial.

Responsibilities

Conduct security assessments using SAST, DAST, and SCA tools to identify application vulnerabilities.
Perform code reviews and provide secure coding guidance to development teams.
Implement and maintain GitHub Advanced Security, including secret scanning and code scanning.
Work with Engineering teams to triage and remediate identified vulnerabilities.
Support CI/CD security integration and automation.
Review and secure API implementations, with a focus on GraphQL security.
Maintain security documentation.