Sr. Application Security Engineer

hims-and-hers; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Remote role

Health benefits

Parental leave

Retirement matching

Employee stock purchase

Flexible time off

Company holidays

Mental health days

Team retreats

Job summary

hims-and-hers is seeking an experienced Application Security Engineer to protect software across the development lifecycle, conduct secure code reviews, and guide remediation. The role emphasizes API security with a focus on GraphQL and requires strong collaboration with engineering teams.

This is a remote position operating within established security and compliance frameworks. Applicants should have a bachelor’s degree, 5–8 years in application security, hands-on coding ability, and experience

Qualifications

• Bachelor’s degree in computer science, cybersecurity, information technology, or a related field.
• Five to eight years of experience in application security or a related security discipline.
• Hands-on coding experience and ability to review code across multiple languages.
• Professional experience with SAST, DAST, and SCA tools, including GitHub Advanced Security.
• Strong knowledge of the OWASP Top 10 and secure development practices.
• Clear communication skills for explaining security findings to technical and nontechnical partners.

Responsibilities

• Assess applications with static, dynamic, and dependency analysis tools to identify vulnerabilities.
• Review code and provide practical secure coding guidance to developers.
• Configure and maintain code scanning and secret scanning capabilities in GitHub Advanced Security.
• Triage findings with engineering teams and help drive remediation.
• Integrate security checks and automation into CI/CD workflows.
• Review API implementations, especially GraphQL, and maintain security documentation.

Skills

Hands-on coding experience

Secure code review

Clear communication

Explain security findings to non-tech

Education

Bachelor’s degree in computer science / cybersecurity / IT

Tools

SAST tools

DAST tools

SCA tools

GitHub Advanced Security

Job description

Role overview

Help protect applications throughout the software development lifecycle by finding security weaknesses, guiding engineering teams toward safer implementations, and embedding security checks into delivery workflows. The role includes application assessments, secure code review, vulnerability remediation support, and API security, with particular attention to GraphQL. It is remote and operates within established security and compliance frameworks.

Responsibilities

• Assess applications with static, dynamic, and dependency analysis tools to identify vulnerabilities.
• Review code and provide practical secure coding guidance to developers.
• Configure and maintain code scanning and secret scanning capabilities in GitHub Advanced Security.
• Triage findings with engineering teams and help drive remediation.
• Integrate security checks and automation into CI/CD workflows.
• Review API implementations, especially GraphQL, and maintain security documentation.

Requirements

• Bachelor’s degree in computer science, cybersecurity, information technology, or a related field.
• Five to eight years of experience in application security or a related security discipline.
• Hands-on coding experience and ability to review code across multiple languages.
• Professional experience with SAST, DAST, and SCA tools, including GitHub Advanced Security.
• Strong knowledge of the OWASP Top 10 and secure development practices.
• Clear communication skills for explaining security findings to technical and nontechnical partners.

Nice to have

• Experience configuring Cloudflare WAF or bot management, or automating security tasks with Python, Go, or similar languages.
• Contributions to security research, tools, or presentations; experience in healthcare or another regulated industry.
• Familiarity with AWS, multi-cloud environments, Jenkins, GitHub Actions, or comparable CI/CD tools.

Benefits and work setup

• Remote role. The work follows security and compliance frameworks including NIST CSF, NIST 800-53, SOC 2, and PCI DSS.
• Full-time compensation may include salary and equity, along with health, dental, vision, and parental leave benefits, retirement matching, employee stock purchase, flexible time off, company holidays, mental health days, and team retreats.