Senior Application Security Engineer

hims & hers

. Conduct security assessments using SAST, DAST, and SCA tools to identify vulnerabilities in applications .

Posted 11/4/2026full-timeRemote • United StatesSenior💰 $135,000 - $165,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in application security assessments, secure coding practices, and vulnerability management, with proficiency in SAST, DAST, and SCA tools. Strong communication skills facilitate effective collaboration with technical and non-technical stakeholders.

Highest-signal resume keywords

Application Security AssessmentsSAST Tools (GHAS)DAST Tools (Burp Suite, OWASP ZAP)Secure Coding PracticesCI/CD Security Integration

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Code ReviewVulnerability ManagementPythonJavaScriptJavaGoGitAWSJenkinsGitHub Actions

Soft Skills

Excellent Communication SkillsCollaboration

Tools & Technologies

GitHub Advanced SecurityBurp SuiteOWASP ZAPBlack DuckWhiteSourceCloudflare WAFBot Management

Industry Keywords

NIST CSFNIST 800-53SOC 2PCI DSSHealthcare

Tech Stack

Tools & technologies

AWSCloudCyber SecurityGraphQLJavaJavaScriptJenkinsPythonTypeScriptGo

About the role

Key responsibilities & impact

Conduct security assessments using SAST, DAST, and SCA tools to identify vulnerabilities in applications
Perform code reviews and provide secure coding guidance to development teams
Implement and maintain GitHub Advanced Security, including secret scanning and code scanning
Work with Engineering teams to triage and fix identified vulnerabilities
Support CI/CD security integration and automation
Review and secure API implementations, with focus on GraphQL security
Maintain security documentation
Balance security requirements with business needs
Manage multiple security assessments simultaneously
Support compliance with NIST CSF, NIST 800-53, SOC 2, and PCI DSS frameworks

Requirements

What you’ll need

Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field
5-8 years of experience in application security or related security field
Hands-on coding experience and ability to review code in multiple languages
Professional experience with SAST tools (e.g., GHAS)
Professional experience with DAST tools (e.g., Burp Suite, OWASP ZAP)
Professional experience with SCA tools (e.g., GHAS, Black Duck, WhiteSource)
Experience with GitHub Advanced Security features
Strong understanding of OWASP Top 10 and secure coding practices
Excellent communication skills to articulate security findings to technical and non-technical stakeholders
Proficiency in reviewing Python, JavaScript, Java, Go, and other modern languages
Development skills in languages like JS and TS
Familiarity with git
AWS experience; multi-cloud experience beneficial
Experience with Jenkins, GitHub Actions, or similar CI/CD tools
Ability to work in the United States
Preferred: Cloudflare WAF and Bot Management configuration
Preferred: Security automation and scripting (Python, Go, or similar)
Preferred: Contributions to the security community
Preferred: Experience in healthcare or regulated industries

Benefits

Comp & perks

Competitive salary
Equity compensation for full-time roles
Unlimited PTO
Company holidays
Quarterly mental health days
Comprehensive medical, dental, and vision health benefits
Parental leave
Employee Stock Purchase Program (ESPP)
401k benefits with employer matching contribution
Offsite team retreats
Flexible/remote work approach