Senior Application Security Engineer

Location: US - Remote

Salary: $135K–$165K plus equity

Company

Hims & Hers is a public health and wellness company delivering personalized healthcare access from diagnosis through treatment and delivery.

What you will do

• Conduct application security assessments using SAST, DAST, and SCA tools.
• Perform code reviews and provide secure coding guidance to development teams.
• Implement and maintain GitHub Advanced Security, including secret scanning and code scanning.
• Partner with Engineering teams to triage and remediate vulnerabilities.
• Integrate and automate security controls across CI/CD pipelines.
• Review and secure API implementations, with a focus on GraphQL, and maintain security documentation.

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field.
• 5–8 years of experience in application security or a related security field.
• Hands-on coding experience and the ability to review code in multiple languages, including Python, JavaScript, Java, Go, and other modern languages.
• Professional experience with SAST tools, including GHAS, DAST tools such as Burp Suite or OWASP ZAP, and SCA tools such as GHAS, Black Duck, or WhiteSource.
• Experience with GitHub Advanced Security features and a strong understanding of the OWASP Top 10 and secure coding practices.
• Experience with AWS and CI/CD tools such as Jenkins, GitHub Actions, or similar.
• Excellent communication skills for explaining security findings to technical and non-technical stakeholders.
• Ability to balance security requirements with business needs, collaborate with development teams, and manage multiple security assessments simultaneously.

Nice to have

• Cloudflare WAF and Bot Management configuration experience.
• Security automation and scripting with Python, Go, or similar languages.
• Contributions to the security community through research, tools, or presentations.
• Experience in healthcare or regulated industries.
• Multi-cloud experience and familiarity with Git.

Culture & Benefits

• Full-time remote work with a flexible, talent-first approach.
• Unlimited PTO, company holidays, and quarterly mental health days.
• Medical, dental, and vision coverage, parental leave, and 401(k) matching.
• Employee Stock Purchase Program, equity compensation, and offsite team retreats.
• Security practices aligned with NIST CSF, NIST 800-53, SOC 2, and PCI DSS frameworks.