Strategic Overview
Sr. Application Security Engineer at Hims & Hers is defined by the responsibilities and candidate requirements in the employer's listing.
The published role emphasizes work such as Implement and maintain GitHub Advanced Security, including secret scanning and code scanning.
The role is listed for United States with a remote working arrangement, giving candidates the practical context needed to assess fit before applying.
Key information at a glance
About This Role
Hims & Hers is the leading health and wellness platform, on a mission to help the world feel great through the power of better health. We are redefining healthcare by putting the customer first and delivering access to care that is affordable, accessible, and personal, from diagnosis to treatment to delivery. No two people are the same, so we provide access to personalized care designed for results.
Hims & Hers is a public company, traded on the NYSE under the ticker symbol “HIMS.” To learn more about the brand and offerings, you can visit hims.com/about and hims.com/how-it-works . For information on the company’s outstanding benefits, culture, and its talent-first flexible/remote work approach, see below and visit .
Key Responsibilities & Objectives
- Implement and maintain GitHub Advanced Security, including secret scanning and code scanning
- Support CI/CD security integration and automation
- Maintain security documentation
- Self-motivated individual who can manage multiple security assessments simultaneously
Required Qualifications & Candidate Blueprint
- Someone who can balance security requirements with business needs
- Strong collaborator who can work effectively with development teams
- Self-motivated individual who can manage multiple security assessments simultaneously
Preferred Qualifications
- Cloudflare WAF and Bot Management configuration (nice to have)
- Security automation and scripting (Python, Go, or similar)
- Contributions to the security community (research, tools, presentations)
- Experience in healthcare or regulated industries
Salary & Benefits
Published compensation: USD 135,000 – 165,000 / yearly
- Competitive salary & equity compensation for full-time roles
- Unlimited PTO, company holidays, and quarterly mental health days
- Comprehensive health benefits including medical, dental & vision, and parental leave
- Employee Stock Purchase Program (ESPP)
- 401k benefits with employer matching contribution
- Offsite team retreats
Salary Benchmark
This role’s published compensation is compared with active employer-disclosed ranges for the same role at the Senior level, in the same currency and pay period.
Benchmark uses active employer job postings in our database, excludes this listing, and matches the currency and pay period. It is not a third-party salary estimate; currencies are not converted.
Full Job Description
The following is the complete job description supplied by the source. We sanitize unsafe markup and remove external links, but do not shorten or rewrite the employer's source content.
Hims & Hers is the leading health and wellness platform, on a mission to help the world feel great through the power of better health. We are redefining healthcare by putting the customer first and delivering access to care that is affordable, accessible, and personal, from diagnosis to treatment to delivery. No two people are the same, so we provide access to personalized care designed for results. By normalizing health & wellness challenges and innovating on their solutions, we’re making better health outcomes easier to achieve.
Hims & Hers is a public company, traded on the NYSE under the ticker symbol “HIMS.” To learn more about the brand and offerings, you can visit hims.com/about and hims.com/how-it-works . For information on the company’s outstanding benefits, culture, and its talent-first flexible/remote work approach, see below and visit .
About the Role:
We are seeking a Senior Application Security Engineer to join our security team. This role will focus on ensuring the security of our applications throughout the development lifecycle, with an emphasis on modern security practices. You will work closely with development teams to implement secure coding practices and maintain our application security posture.
You Will:
Conduct security assessments using SAST, DAST, and SCA tools to identify vulnerabilities in applications
Perform code reviews and provide secure coding guidance to development teams
Implement and maintain GitHub Advanced Security, including secret scanning and code scanning
Work with Engineering teams to triage and fix identified vulnerabilities
Support CI/CD security integration and automation
Review and secure API implementations, with focus on GraphQL security
Maintain security documentation
You Have:
Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field
5-8 years of experience in application security or related security field
Hands-on coding experience and ability to review code in multiple languages
Professional experience with SAST tools (e.g., GHAS)
Professional experience with DAST tools (e.g., Burp Suite, OWASP ZAP)
Professional experience with SCA tools (e.g., GHAS, Black Duck, WhiteSource)
Experience with GitHub Advanced Security features
Strong understanding of OWASP Top 10 and secure coding practices
Excellent communication skills to articulate security findings to technical and non-technical stakeholders
Preferred Qualifications
Cloudflare WAF and Bot Management configuration (nice to have)
Security automation and scripting (Python, Go, or similar)
Contributions to the security community (research, tools, presentations)
Experience in healthcare or regulated industries
Technical Stack
Security Tools:, Burp Suite, GitHub Advanced Security,
Languages: Proficiency in reviewing Python, JavaScript, Java, Go, and other modern languages
Development skills in languages like JS, TS. Familiarity with git.
Cloud: AWS (primary), multi-cloud experience beneficial
CI/CD: Experience with Jenkins, GitHub Actions, or similar
What We're Looking For
Someone who can balance security requirements with business needs
Strong collaborator who can work effectively with development teams
Self-motivated individual who can manage multiple security assessments simultaneously
Additional Information
This is a remote position. We are a healthcare company that adheres to NIST CSF, NIST 800-53, SOC 2, and PCI DSS compliance frameworks.
Our Benefits (there are more but here are some highlights):
Competitive salary & equity compensation for full-time roles
Unlimited PTO, company holidays, and quarterly mental health days
Comprehensive health benefits including medical, dental & vision, and parental leave
Employee Stock Purchase Program (ESPP)
401k benefits with employer matching contribution
Offsite team retreats
We are committed to building a workforce that reflects diverse perspectives and prioritizes ethics, wellness, and a strong sense of belonging. If you're excited about this role, we encourage you to apply—even if you're not sure if your background or experience is a perfect match.
Hims considers all qualified applicants for employment, including applicants with arrest or conviction records, in accordance with the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance, the California Fair Chance Act, and any similar state or local fair chance laws.
It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
Hims & Hers is committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please contact us at accommodations@forhims.com and describe the needed accommodation. Your privacy is important to us, and any information you share will only be used for the legitimate purpose of considering your request for accommodation. Hims & Hers gives consideration to all qualified applicants without regard to any protected status, including disability. Please do not send resumes to this email address.
To learn more about how we collect, use, retain, and disclose Personal Information, please visit our Global Candidate Privacy Statement.
Editor’s Market Perspective (Our Custom Analysis)
Why This Position Matters
This opening may suit candidates who can demonstrate experience relevant to the employer's published requirements. Its strongest career signal is the scope of the work itself — particularly Implement and maintain GitHub Advanced Security, including secret scanning and code scanning — rather than a generic title alone.
Resume & Application Strategy
For the application, connect specific examples from your experience to the responsibilities and qualifications in the employer's description. Quantify outcomes from comparable work, and place the most relevant evidence near the top of the resume. When the employer explicitly names tools, platforms, leadership scope, or domain experience, use those source terms accurately and in context.
We organize source-provided information into this independent job-seeker overview. Compensation is shown only when the source provides it; the official listing remains the authority for current requirements and application instructions.