Lead Application Security Architect - Remote

iHerb; California (MO); Hybrid; USD 177,000 - 225,000; Full time

Job summary

iHerb is seeking a senior security leader to drive secure design and architecture across our services. You will lead cross‑functional initiatives, oversee threat modeling, and implement scalable security solutions within a DevOps ecosystem.

The role requires 8+ years of leadership in security for large web platforms, strong programming knowledge, and the ability to translate technical risks into business impact. Remote within the United States is supported.

Qualifications

• Degree in Computer Science/Engineering or equivalent experience.

Responsibilities

• Lead cross‑functional projects and establish cutting‑edge security development lifecycle practices.
• Direct security design reviews and threat modeling for new and existing services at iHerb.
• Evaluate, prototype, implement, and operate security‑focused tools and services.
• Create secure architecture standards, frameworks, and patterns spanning multiple layers.
• Discover and analyze emerging security threats, determining applicability to iHerb, and proactively implement centralized mitigations.
• Maintain knowledge of current security threats and operational best practices.
• Drive security assessment, penetration testing, and bug bounty programs.
• Participate in security incident response.

Skills

Security leadership

Threat modeling

Data-driven decisions

Problem solving

Communication

Collaboration

Presentation

Risk assessment

Analytical thinking

Education

Bachelor's degree in Computer Science / Engineering

Equivalent experience

Tools

Python

C# .NET

JavaScript

Node.js

Java

Docker

AWS

Cloudflare

Job description

iHerb is seeking a senior security leader to drive secure design and architecture across our services. You will lead cross‑functional initiatives, oversee threat modeling, and implement scalable security solutions within a DevOps ecosystem.

The role requires 8+ years of leadership in security for large web platforms, strong programming knowledge, and the ability to translate technical risks into business impact. Remote within the United States is supported.