{"id":3766983,"url":"https://alion.io/job/hims-hers-sr-application-security-engineer","title":"Sr. Application Security Engineer","company":{"id":6261,"name":"Hims & Hers","domain":"hims.com","url":"https://alion.io/company/hims","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":89,"open_postings":7,"ghost_share":0,"stale_share":0.429,"repost_share":0,"time_to_fill_p50_days":47,"computed_at":"2026-11-06T05:58:05Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":135000,"max":165000,"currency":"USD","period":"year","gross":null,"usd_annual":165000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"CI/CD","optional":false},{"name":"GitHub","optional":false},{"name":"GraphQL","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"OWASP ZAP","optional":false},{"name":"AWS","optional":true},{"name":"Cloudflare WAF","optional":true},{"name":"GitHub Actions","optional":true},{"name":"JavaScript","optional":true},{"name":"Jenkins","optional":true},{"name":"NIST 800-53","optional":true},{"name":"NIST CSF","optional":true},{"name":"PCI DSS","optional":true},{"name":"Python","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-11-04T16:42:41Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-07T00:39:41Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Hims & Hers is the leading health and wellness platform, on a mission to help the world feel great through the power of better health. We are redefining healthcare by putting the customer first and delivering access to care that is affordable, accessible, and personal, from diagnosis to treatment to delivery. No two people are the same, so we provide access to personalized care designed for results. By normalizing health & wellness challenges and innovating on their solutions, we’re making better health outcomes easier to achieve.\nHims & Hers is a public company, traded on the NYSE under the ticker symbol “HIMS.” To learn more about the brand and offerings, you can visit hims.com/about and hims.com/how-it-works . For information on the company’s outstanding benefits, culture, and its talent-first flexible/remote work approach, see below and visit www.hims.com/careers-professionals.\nAbout the Role:\nWe are seeking a Senior Application Security Engineer to join our security team. This role will focus on ensuring the security of our applications throughout the development lifecycle, with an emphasis on modern security practices. You will work closely with development teams to implement secure coding practices and maintain our application security posture.\nYou Will:\nConduct security assessments using SAST, DAST, and SCA tools to identify vulnerabilities in applications\n\nPerform code reviews and provide secure coding guidance to development teams\n\nImplement and maintain GitHub Advanced Security, including secret scanning and code scanning\n\nWork with Engineering teams to triage and fix identified vulnerabilities\n\nSupport CI/CD security integration and automation\n\nReview and secure API implementations, with focus on GraphQL security\n\nMaintain security documentation\n\nYou Have:\nBachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field\n\n5-8 years of experience in application security or related security field\n\nHands-on coding experience and ability to review code in multiple languages\n\nProfessional experience with SAST tools (e.g., GHAS)\n\nProfessional experience with DAST tools (e.g., Burp Suite, OWASP ZAP)\n\nProfessional experience with SCA tools (e.g., GHAS, Black Duck, WhiteSource)\n\nExperience with GitHub Advanced Security features\n\nStrong understanding of OWASP Top 10 and secure coding practices\n\nExcellent communication skills to articulate security findings to technical and non-technical stakeholders\n\nPreferred Qualifications\nCloudflare WAF and Bot Management configuration (nice to have)\n\nSecurity automation and scripting (Python, Go, or similar)\n\nContributions to the security community (research, tools, presentations)\n\nExperience in healthcare or regulated industries\n\nTechnical Stack\nSecurity Tools:, Burp Suite, GitHub Advanced Security,\n\nLanguages: Proficiency in reviewing Python, JavaScript, Java, Go, and other modern languages\n\nDevelopment skills in languages like JS, TS. Familiarity with git.\n\nCloud: AWS (primary), multi-cloud experience beneficial\n\nCI/CD: Experience with Jenkins, GitHub Actions, or similar\n\nWhat We're Looking For\nSomeone who can balance security requirements with business needs\n\nStrong collaborator who can work effectively with development teams\n\nSelf-motivated individual who can manage multiple security assessments simultaneously\n\nAdditional Information\nThis is a remote position. We are a healthcare company that adheres to NIST CSF, NIST 800-53, SOC 2, and PCI DSS compliance frameworks.\nOur Benefits (there are more but here are some highlights):\nCompetitive salary & equity compensation for full-time roles\n\nUnlimited PTO, company holidays, and quarterly mental health days\n\nComprehensive health benefits including medical, dental & vision, and parental leave\n\nEmployee Stock Purchase Program (ESPP)\n\n401k benefits with employer matching contribution\n\nOffsite team retreats\n\nWe are committed to building a workforce that reflects diverse perspectives and prioritizes ethics, wellness, and a strong sense of belonging. If you're excited about this role, we encourage you to apply-even if you're not sure if your background or experience is a perfect match.\nHims considers all qualified applicants for employment, including applicants with arrest or conviction records, in accordance with the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance, the California Fair Chance Act, and any similar state or local fair chance laws.\nIt is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.\nHims & Hers is committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please contact us at  and describe the needed accommodation. Your privacy is important to us, and any information you share will only be used for the legitimate purpose of considering your request for accommodation. Hims & Hers gives consideration to all qualified applicants without regard to any protected status, including disability. Please do not send resumes to this email address.\nTo learn more about how we collect, use, retain, and disclose Personal Information, please visit our Global Candidate Privacy Statement.","description_format":"text","description_chars":5477,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["401k plan","Equity","Parental leave","Unlimited PTO"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Telemedicine & Virtual Care","Pharmacies"],"lifecycle":[{"event":"open","at":"2026-11-04T20:21:15Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 26 · green card filings: 6","filings_12m":26,"filings_prev_12m":18,"green_card_filings_12m":6,"median_offered_wage_usd":155000,"route":null,"cap_exempt":false,"checked_at":"2026-11-06T22:30:08+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":47,"reasons":["conf:3","velocity","win:early","comp:brand"],"computed_at":"2026-11-06T05:58:05Z"},"pay":{"stated_usd_annual":165000,"is_top_pay":true},"html_url":"https://alion.io/job/hims-hers-sr-application-security-engineer","json_url":"https://alion.io/job/hims-hers-sr-application-security-engineer.json","meta":{"generated_at":"2026-11-07T04:34:04Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11150,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6261},"rest":"https://alion.io/mcp/rest/get_company?id=6261"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhims-hers-sr-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhims-hers-sr-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhims-hers-sr-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/hims-hers-sr-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhims-hers-sr-application-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3766983}},{"tool":"search_jobs","arguments":{"company":"hims.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3766983},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}