# Sr. Application Security Engineer

**Company**: Hims & Hers
**Location**: Remote, US
**Work arrangement**: remote
**Experience**: senior
**Job type**: full-time
**Salary**: $135K - $165K
**Category**: Security
**Industry**: Healthcare

**Apply**: https://jobs.ashbyhq.com/hims-and-hers/f2cec81e-5ba5-46a8-83ba-3e298932f786?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_e9c2a875-828

## Description

Hims & Hers is the leading health and wellness platform, on a mission to help the world feel great through the power of better health.

We are seeking a Senior Application Security Engineer to join our security team, focusing on ensuring the security of our applications throughout the development lifecycle with an emphasis on modern security practices.

You will:

- Conduct security assessments using SAST, DAST, and SCA tools to identify vulnerabilities in applications

- Perform code reviews and provide secure coding guidance to development teams

- Implement and maintain GitHub Advanced Security, including secret scanning and code scanning

- Work with Engineering teams to triage and fix identified vulnerabilities

- Support CI/CD security integration and automation

- Review and secure API implementations, with a focus on GraphQL security

- Maintain security documentation

You have:

- Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field

- 5-8 years of experience in application security or a related security field

- Hands-on coding experience and ability to review code in multiple languages

- Professional experience with SAST tools (e.g., GHAS)

- Professional experience with DAST tools (e.g., Burp Suite, OWASP ZAP)

- Professional experience with SCA tools (e.g., GHAS, Black Duck, WhiteSource)

- Experience with GitHub Advanced Security features

- Strong understanding of OWASP Top 10 and secure coding practices

- Excellent communication skills to articulate security findings to technical and non-technical stakeholders

Preferred qualifications:

- Cloudflare WAF and Bot Management configuration

- Security automation and scripting (Python, Go, or similar)

- Contributions to the security community (research, tools, presentations)

- Experience in healthcare or regulated industries

Technical stack:

- Security Tools: Burp Suite, GitHub Advanced Security

- Languages: Proficiency in reviewing Python, JavaScript, Java, Go, and other modern languages

- Development skills in languages like JS, TS. Familiarity with git.

- Cloud: AWS (primary), multi-cloud experience beneficial

- CI/CD: Experience with Jenkins, GitHub Actions, or similar

For more fresh new jobs, check out [yubhub.co](https://yubhub.co/).

## Skills

### Required
- SAST tools
- DAST tools
- SCA tools
- GitHub Advanced Security
- OWASP Top 10
- secure coding practices
- Python
- JavaScript
- Java
- Go

### Nice to have
- Cloudflare WAF
- Bot Management
- security automation
- scripting

---

Source: [Apply at jobs.ashbyhq.com](https://jobs.ashbyhq.com/hims-and-hers/f2cec81e-5ba5-46a8-83ba-3e298932f786?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)