Sr. Application Security Engineer

Hims & Hers is the leading health and wellness platform, on a mission to help the world feel great through the power of better health.

We are seeking a Senior Application Security Engineer to join our security team, focusing on ensuring the security of our applications throughout the development lifecycle with an emphasis on modern security practices.

You will:

• Conduct security assessments using SAST, DAST, and SCA tools to identify vulnerabilities in applications
• Perform code reviews and provide secure coding guidance to development teams
• Implement and maintain GitHub Advanced Security, including secret scanning and code scanning
• Work with Engineering teams to triage and fix identified vulnerabilities
• Support CI/CD security integration and automation
• Review and secure API implementations, with a focus on GraphQL security
• Maintain security documentation

You have:

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field
• 5-8 years of experience in application security or a related security field
• Hands-on coding experience and ability to review code in multiple languages
• Professional experience with SAST tools (e.g., GHAS)
• Professional experience with DAST tools (e.g., Burp Suite, OWASP ZAP)
• Professional experience with SCA tools (e.g., GHAS, Black Duck, WhiteSource)
• Experience with GitHub Advanced Security features
• Strong understanding of OWASP Top 10 and secure coding practices
• Excellent communication skills to articulate security findings to technical and non-technical stakeholders

Preferred qualifications:

• Cloudflare WAF and Bot Management configuration
• Security automation and scripting (Python, Go, or similar)
• Contributions to the security community (research, tools, presentations)
• Experience in healthcare or regulated industries

Technical stack:

• Security Tools: Burp Suite, GitHub Advanced Security
• Languages: Proficiency in reviewing Python, JavaScript, Java, Go, and other modern languages
• Development skills in languages like JS, TS. Familiarity with git.
• Cloud: AWS (primary), multi-cloud experience beneficial
• CI/CD: Experience with Jenkins, GitHub Actions, or similar