[All remote jobs](https://jobicy.com/jobs.md)[![hims & hers logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/11/e7b9b920-221.jpeg)](https://jobicy.com/company/hims-hers.md)[hims & hers](https://jobicy.com/company/hims-hers.md) # Sr. Application Security Engineer AI Summary Hims & Hers is seeking a senior application security engineer to strengthen security throughout the software development lifecycle for its healthcare platform. The role conducts SAST, DAST, and SCA assessments, reviews code, guides remediation, and integrates security controls into CI/CD workflows. It requires hands-on experience with GitHub Advanced Security, API and GraphQL security, OWASP guidance, and coding across modern languages. The engineer will partner closely with development teams while operating within NIST, SOC 2, and PCI DSS-oriented compliance requirements. This is a full-time remote role restricted to the United States.[Apply for this job](#job-application)[View company](https://jobicy.com/company/hims-hers.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 135k–165k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished6 Nov 2026Apply before6 Dec 2026Listing views48Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. Hims & Hers is the leading health and wellness platform, on a mission to help the world feel great through the power of better health. We are redefining healthcare by putting the customer first and delivering access to care that is affordable, accessible, and personal, from diagnosis to treatment to delivery. No two people are the same, so we provide access to personalized care designed for results. By normalizing health & wellness challenges and innovating on their solutions, we’re making better health outcomes easier to achieve. Hims & Hers is a public company, traded on the NYSE under the ticker symbol “HIMS.” To learn more about the brand and offerings, you can visit [hims.com/about](http://hims.com/about) and [hims.com/how-it-works](http://hims.com/how-it-works) . For information on the company’s outstanding benefits, culture, and its talent-first flexible/remote work approach, see below and visit [www.hims.com/careers-professionals](http://www.hims.com/careers-professionals). ### About the Role: We are seeking a Senior Application Security Engineer to join our security team. This role will focus on ensuring the security of our applications throughout the development lifecycle, with an emphasis on modern security practices. You will work closely with development teams to implement secure coding practices and maintain our application security posture. ### You Will: * Conduct security assessments using SAST, DAST, and SCA tools to identify vulnerabilities in applications * Perform code reviews and provide secure coding guidance to development teams * Implement and maintain GitHub Advanced Security, including secret scanning and code scanning * Work with Engineering teams to triage and fix identified vulnerabilities * Support CI/CD security integration and automation * Review and secure API implementations, with focus on GraphQL security * Maintain security documentation ### You Have: * Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or related field * 5-8 years of experience in application security or related security field * Hands-on coding experience and ability to review code in multiple languages * Professional experience with SAST tools (e.g., GHAS) * Professional experience with DAST tools (e.g., Burp Suite, OWASP ZAP) * Professional experience with SCA tools (e.g., GHAS, Black Duck, WhiteSource) * Experience with GitHub Advanced Security features * Strong understanding of OWASP Top 10 and secure coding practices * Excellent communication skills to articulate security findings to technical and non-technical stakeholders ### Preferred Qualifications * Cloudflare WAF and Bot Management configuration (nice to have) * Security automation and scripting (Python, Go, or similar) * Contributions to the security community (research, tools, presentations) * Experience in healthcare or regulated industries ### Technical Stack * Security Tools:, Burp Suite, GitHub Advanced Security, * Languages: Proficiency in reviewing Python, JavaScript, Java, Go, and other modern languages * Development skills in languages like JS, TS. Familiarity with git. * Cloud: AWS (primary), multi-cloud experience beneficial * CI/CD: Experience with Jenkins, GitHub Actions, or similar ### What We’re Looking For * Someone who can balance security requirements with business needs * Strong collaborator who can work effectively with development teams * Self-motivated individual who can manage multiple security assessments simultaneously ### Additional Information This is a remote position. We are a healthcare company that adheres to NIST CSF, NIST 800-53, SOC 2, and PCI DSS compliance frameworks. ### Our Benefits (there are more but here are some highlights): * Competitive salary & equity compensation for full-time roles * Unlimited PTO, company holidays, and quarterly mental health days * Comprehensive health benefits including medical, dental & vision, and parental leave * Employee Stock Purchase Program (ESPP) * 401k benefits with employer matching contribution * Offsite team retreats We are committed to building a workforce that reflects diverse perspectives and prioritizes ethics, wellness, and a strong sense of belonging. If you’re excited about this role, we encourage you to apply—even if you’re not sure if your background or experience is a perfect match. Hims considers all qualified applicants for employment, including applicants with arrest or conviction records, in accordance with the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance, the California Fair Chance Act, and any similar state or local fair chance laws. It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability. Hims & Hers is committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please contact us at [accommodations@forhims.com](mailto:accommodations@forhims.com) and describe the needed accommodation. Your privacy is important to us, and any information you share will only be used for the legitimate purpose of considering your request for accommodation. Hims & Hers gives consideration to all qualified applicants without regard to any protected status, including disability. Please do not send resumes to this email address. To learn more about how we collect, use, retain, and disclose Personal Information, please visit our [Global Candidate Privacy Statement](https://www.hims.com/global-candidate-privacy-statement). Show more [Apply now >](https://jobicy.com/jobs/159371-sr-application-security-engineer.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 4/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThe position requires 5–8 years of application-security experience, practical code-review capability, and expertise across multiple security-testing disciplines. It also demands sound risk judgment and clear communication with both engineering and non-technical stakeholders in a regulated environment. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$150,000US market range (per year)$135k–$180k0$198.00k AI insightThe employer discloses a base salary range of $135,000–$165,000 USD per year, with a midpoint of $150,000. This is a credible annual range for a senior application security engineer in the US remote market; the estimated broader market range is $135,000–$180,000 annually. ## Core skills Skills and capabilities most closely associated with this opportunity. [Application Security](https://jobicy.com/jobs?search_keywords=Application%20Security.md)[Secure Code Review](https://jobicy.com/jobs?search_keywords=Secure%20Code%20Review.md)[SAST](https://jobicy.com/jobs?search_keywords=SAST.md)[DAST](https://jobicy.com/jobs?search_keywords=DAST.md)[Software Composition Analysis](https://jobicy.com/jobs?search_keywords=Software%20Composition%20Analysis.md)[GitHub Advanced Security](https://jobicy.com/jobs?search_keywords=GitHub%20Advanced%20Security.md)[OWASP Top 10](https://jobicy.com/jobs?search_keywords=OWASP%20Top%2010.md)[API Security](https://jobicy.com/jobs?search_keywords=API%20Security.md)[GraphQL Security](https://jobicy.com/jobs?search_keywords=GraphQL%20Security.md)[CI/CD Security](https://jobicy.com/jobs?search_keywords=CICD%20Security.md)[Vulnerability Management](https://jobicy.com/jobs?search_keywords=Vulnerability%20Management.md)[AWS Security](https://jobicy.com/jobs?search_keywords=AWS%20Security.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[Security Automation](https://jobicy.com/jobs?search_keywords=Security%20Automation.md)[NIST CSF](https://jobicy.com/jobs?search_keywords=NIST%20CSF.md) Sample interview questionsHow would you introduce SAST, DAST, and SCA into a CI/CD pipeline without creating excessive friction for developers?I would start by baselining findings and tuning each tool to reduce false positives. I would use severity-based gates for newly introduced critical issues, provide actionable remediation guidance in pull requests, and track legacy findings through a risk-based backlog rather than blocking all releases. What are key security considerations when reviewing a GraphQL API? I would review authorization at the resolver level, validate input handling, enforce query depth and complexity limits, control introspection appropriately, and ensure sensitive fields cannot be accessed through indirect object references. I would also test rate limiting, error handling, and schema exposure. How do you prioritize a large queue of application vulnerabilities? I assess exploitability, business impact, data sensitivity, internet exposure, affected asset criticality, and the availability of compensating controls. I then work with service owners to define remediation timelines and escalate urgent issues with clear evidence and practical mitigation options. Describe how you would use GitHub Advanced Security to improve an engineering organization's security posture. I would enable code scanning, secret scanning, dependency review, and Dependabot alerts across priority repositories. I would establish ownership and triage workflows, tune detection rules, integrate findings into developer processes, and measure remediation time and recurring vulnerability patterns. How would you explain a significant security finding to a non-technical stakeholder? I would describe the affected business process, the realistic impact, likelihood, and recommended decision in plain language. I would avoid jargon, distinguish confirmed risk from theoretical risk, and present remediation options with trade-offs, owners, and timelines. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Samsara logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/dd26f5ca-221.jpg) Samsara Nov 6 New ### [Security Operations Engineer](https://jobicy.com/jobs/159442-security-operations-engineer.md) Who we are Samsara (NYSE: IOT) is the pioneer of the Connected Operations™ Cloud, which is a platform that enables organizations that depend on physical operations to harness Internet of… * ![Rithum logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/fe3986d8-221-1.jpeg) Rithum Nov 6 New ### [Staff Information Security Engineer](https://jobicy.com/jobs/159389-staff-information-security-engineer-2.md) Rithum™ is the world’s most trusted commerce network, accelerating how brands, suppliers, and retailers work together to deliver seamless e-commerce experiences. We provide an unmatched platform for brands and retailers,… * ![Spotify logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210328105941-289246.jpg) Spotify Nov 6 New ### [Security Engineer – Product Security](https://jobicy.com/jobs/159248-security-engineer-product-security.md) The Platform team creates the technology that enables Spotify to learn quickly and scale easily, enabling rapid growth in our users and our business around the globe. Spanning many disciplines,… * ![Roofr logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/03/1a4a90db-221.jpg) Roofr Nov 6 New ### [Senior Security Engineer](https://jobicy.com/jobs/159233-senior-security-engineer-2.md) At Roofr, we’re obsessed with our customers. We constantly gather feedback to shape, prioritize, and launch the products they truly need. That’s what makes Roofr’s CRM special. We started by… * ![Five9 logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/7c3d754e-221.png) Five9 Nov 6 New ### [Cloud Governance Engineer](https://jobicy.com/jobs/154675-cloud-governance-engineer.md) Join us in bringing joy to customer experience. Five9 is a leading provider of cloud contact center software, bringing the power of cloud innovation to customers worldwide. Living our values… * ![Abby Care logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/3d3ea8fe-221.jpeg) Abby Care Nov 6 New ### [Senior Security Analyst](https://jobicy.com/jobs/154692-senior-security-analyst.md) About Abby Care: Powering the future of care at home for all of America. Abby Care is building the leading AI-native platform for family-led care. America is facing a growing… * ![NetBox Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/df239a55-221.png) NetBox Labs Nov 5 New ### [Security Architect](https://jobicy.com/jobs/159190-security-architect.md) NetBox Labs builds NetBox, the open source network source of truth, and the cloud and enterprise products built on it. We’re hiring a hands-on Security Architect: a builder unleashed by… * ![Spotify logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210328105941-289246.jpg) Spotify Nov 5 New ### [Staff Engineer – Identity and Access Management User Platform](https://jobicy.com/jobs/159119-staff-engineer-identity-and-access-management-user-platform.md) The Platform mission creates the technology that enables Spotify to learn quickly and scale easily, enabling rapid growth in our users and our business around the globe. Spanning many disciplines,… * ![Keyfactor, Inc. logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/ba8ae349-221.png) Keyfactor, Inc. Nov 5 New ### [Senior Solutions Consultant](https://jobicy.com/jobs/159061-senior-solutions-consultant-3.md) About Keyfactor Our mission is to securely connect the world: humans, machines, and AI. Keyfactor is the leader in trust infrastructure for AI and machines, helping the world’s largest enterprises… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Nov 5 New ### [Blockchain Security Expert – AI Track](https://jobicy.com/jobs/152451-blockchain-security-expert-ai-track.md) About the Company CertiK is the largest blockchain security auditor and provides a comprehensive suite of tools to secure the industry at scale. To date, CertiK has worked with over… [Browse all jobs](https://jobicy.com/jobs.md)