Security Engineer • Lead

Who you are

You have extensive experience in application security, with a strong focus on securing ecommerce services and applications that serve millions of customers globally. As a Principal Application Security Engineer, you are the ultimate subject matter expert, responsible for establishing enterprise-wide security architecture and driving technical mitigations. You possess unparalleled technical depth and strategic foresight, enabling you to respond effectively to current and emerging security threats.

Your background includes leading cross-functional projects and defining strategic directions for security development lifecycle (SDL) practices. You are skilled in conducting security design reviews and sophisticated threat modeling for mission-critical services across various platforms. You have a proven track record of establishing secure architecture standards and frameworks that span application, cloud-native, and infrastructure layers.

You are adept at evaluating, prototyping, implementing, and governing core security tools and services, including DAST, SAST, SCA, WAF, and Secrets Management. Your ability to discover and analyze emerging security threats allows you to proactively implement centralized mitigations, ensuring compliance excellence in a complex environment.

Desirable

Experience with security automation technologies and a strong understanding of compliance requirements in the ecommerce sector would be advantageous. Familiarity with industry standards and frameworks will further enhance your ability to drive security initiatives effectively.

What you'll do

In this role, you will lead the Secure Development Lifecycle assurance processes, ensuring that security is integrated into every phase of product development. You will collaborate with various teams to implement security hardening strategies and respond to security incidents as they arise. Your responsibilities will include conducting regular security assessments and audits, as well as providing guidance on best practices for secure coding and application design.

You will also be responsible for maintaining a strong knowledge of the latest security trends and threats, continuously updating the security posture of iHerb's applications. Your expertise will be crucial in shaping the security culture within the organization, promoting awareness and training among team members.

What we offer

iHerb provides a fully remote work environment, allowing you to work from the comfort of your home while contributing to a global team. We value diversity and encourage applicants from all backgrounds to apply. As a Principal Application Security Engineer, you will have the opportunity to make a significant impact on the security of our ecommerce platform, ensuring the safety of millions of customers worldwide. We offer competitive compensation and benefits, fostering a supportive and inclusive workplace culture.