Sr. Application Security Engineer

📋 Job Overview

Hims & Hers is the leading health and wellness platform, on a mission to help the world feel great through the power of better health. We are redefining healthcare by putting the customer first and delivering access to care that is affordable, accessible, and personal, from diagnosis to treatment to delivery. No two people are the same, so we provide access to personalized care designed for results. By normalizing health & wellness challenges and innovating on their solutions, we’re making better health outcomes easier to achieve.

🏢 About Hims & Hers

Hims & Hers is a public company, traded on the NYSE under the ticker symbol “HIMS.” To learn more about the brand and offerings, you can visit hims.com/about and hims.com/how-it-works. For information on the company’s outstanding benefits, culture, and its talent-first flexible/remote work approach, see below and visit www.hims.com/careers-professionals.

🎯 The Role

We are seeking a Senior Application Security Engineer to join our security team. This role will focus on ensuring the security of our applications throughout the development lifecycle, with an emphasis on modern security practices. You will work closely with development teams to implement secure coding practices and maintain our application security posture.

✅ Key Responsibilities

• Conduct security assessments using SAST, DAST, and SCA tools to identify vulnerabilities in applications
• Perform code reviews and provide secure coding guidance to development teams
• Implement and maintain GitHub Advanced Security, including secret scanning and code scanning
• Work with Engineering teams to triage and fix identified vulnerabilities
• Support CI/CD security integration and automation
• Review and secure API implementations, with focus on GraphQL security
• Maintain security documentation

📌 Required Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field
• 5-8 years of experience in application security or related security field
• Hands-on coding experience and ability to review code in multiple languages
• Professional experience with SAST tools (e.g., GHAS)
• Professional experience with DAST tools (e.g., Burp Suite, OWASP ZAP)
• Professional experience with SCA tools (e.g., GHAS, Black Duck, WhiteSource)
• Experience with GitHub Advanced Security features
• Strong understanding of OWASP Top 10 and secure coding practices
• Excellent communication skills to articulate security findings to technical and non-technical stakeholders

⭐ Desirable Experience

• Cloudflare WAF and Bot Management configuration (nice to have)
• Security automation and scripting (Python, Go, or similar)
• Contributions to the security community (research, tools, presentations)
• Experience in healthcare or regulated industries

🎁 Benefits

• Competitive salary & equity compensation for full-time roles
• Unlimited PTO, company holidays, and quarterly mental health days
• Comprehensive health benefits including medical, dental & vision, and parental leave
• Employee Stock Purchase Program (ESPP)
• 401k benefits with employer matching contribution
• Offsite team retreats

🛂 Visa & Eligibility

• Hims considers all qualified applicants for employment, including applicants with arrest or conviction records, in accordance with the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance, the California Fair Chance Act, and any similar state or local fair chance laws.
• It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
• Hims & Hers is committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please contact us at [email protected] and describe the needed accommodation.