Principal Application Security Engineer

This is a fully remote position, open to applicants in California.

📋 Description

• Oversee cross-functional projects and set innovative security development lifecycle practices.

• Managed security design evaluations and threat modeling for both new and existing services at iHerb.

• Assess, prototype, implement, and manage security-centric tools and services.

• Establish new secure architecture standards, frameworks, and patterns across various layers.

• Identify and analyze emerging security threats, assess their relevance to iHerb, and proactively institute centralized mitigations.

• Lead our security assessment, penetration testing, and bug bounty initiatives.

⛳️ Requirements

• Over 8 years of technical security leadership experience at a leading software company.

• Proven technical background (Computer Science / Engineering degree or equivalent experience).

• Strong comprehension of common application and infrastructure security vulnerabilities and mitigation strategies (OWASP Top 10, CWE 25, etc.).

• Expertise in implementing SDL processes, technologies, and automation within a DevOps framework.

• Experience with large-scale web applications and microservices, including API design, access management, authorization, authentication, data protection, and encryption.

• Familiarity with major programming languages and frameworks (e.g., Python, C# .NET, JavaScript, Node.js, Java, etc.).

🏝️ Benefits

• Health insurance

• 401(k) matching

• Paid time off

• Flexible work hours

• Professional development opportunities