Principal Application Security Engineer

For A Better You

At iHerb, we believe that living a healthy and balanced life should be easy and accessible to everyone. As a team member, we’ll empower you to live this promise each day as you make a truly global impact in your career.

We constantly strive for innovation, while transforming and improving the online shopping experience for our customers. We believe that individually we are incredible, but when we come together, our growth is infinite. In an industry that is constantly evolving, we are on a mission to make an impact on the global market, and the individual and collaborative efforts of our people are paramount to helping us succeed.

Whether you work in one of our logistics centers, technology hubs, corporate offices or even from home, your role at iHerb will take you beyond what’s expected, turning challenge into change. If you're ready for it, we want you to join our team. Get started now.

Principal Application Security Engineer

Location: Remote, United States. Candidates must reside in the Pacific time zone.

About the Role

iHerb is looking for a hands-on Principal Application Security Engineer to own our Secure Development Lifecycle (SDL), security automation, and product hardening strategy. You will protect an ecommerce platform that serves millions of customers in more than 100 countries, and you will respond to current and emerging threats against it.

You will work with engineering teams around the world to define new security capabilities, help hire and grow the Product Security team, and partner with senior leaders to deliver company-wide security initiatives.

Responsibilities

Secure development lifecycle and architecture

• Lead cross-functional projects and establish modern SDL practices aligned to frameworks such as NIST SSDF, OWASP SAMM, and OWASP ASVS
• Lead security design reviews and threat modeling for new and existing services, and set the standards for how teams do both
• Create secure architecture standards, reference patterns, and paved-road libraries that span application, API, data, and infrastructure layers
• Perform and guide secure code review of high-risk changes such as authentication, payments, and data handling

Security tooling and automation

• Evaluate, prototype, implement, and operate SAST, DAST, SCA, secrets scanning, IaC scanning, and container scanning in CI/CD pipelines
• Build automation that gives developers fast, low-noise feedback and enforces security gates without blocking delivery
• Own vulnerability management for application findings: triage, prioritization by real risk, SLAs, and remediation tracking

Assurance programs

• Drive our security assessment, penetration testing, and bug bounty programs, from scoping through remediation
• Define and report security KPIs, such as time to remediate, vulnerability escape rate, and security champion coverage, to engineering and executive leadership

Cloud, API, and supply chain security

• Harden services running on AWS, containers, and Kubernetes, including network, identity, and secrets management
• Secure APIs and microservices: authentication, authorization, rate limiting, input validation, and abuse prevention
• Secure the software supply chain with SBOMs, dependency governance, build integrity (for example SLSA), and artifact signing
• Protect the storefront against web threats such as account takeover, credential stuffing, bots, and client-side (Magecart-style) script attacks, working with Cloudflare, WAF, and fraud teams

Emerging threats and incident response

• Track emerging threats and vulnerabilities, assess how they apply to iHerb, and implement centralized mitigations
• Evaluate and set guardrails for security risks in AI and LLM-enabled features and developer AI tooling
• Participate in security incident response, including root-cause analysis and follow-up fixes

Leadership and community

• Help mentor security engineers, and build a security champions program with engineering teams
• Partner with Engineering, Privacy, Compliance, and Legal on PCI DSS, GDPR, CCPA, and other regional requirements that affect product design

Required Qualifications

Experience and foundation

• 10+ years in application or product security, with demonstrated technical leadership on large-scale consumer, ecommerce, or SaaS platforms
• Computer Science or Engineering degree, or equivalent experience
• Proven ability to translate technical vulnerabilities into business risk and to influence engineering and executive leaders without direct authority

Application security depth

• Expert knowledge of common vulnerabilities and mitigations (OWASP Top 10, OWASP API Security Top 10, CWE Top 25)
• Hands-on threat modeling and security architecture experience (for example STRIDE or PASTA) across web, mobile, and microservice systems
• Strong grounding in authentication and authorization (OAuth 2.0, OIDC, SAML, JWT, session management, RBAC/ABAC), API security, applied cryptography, and data protection
• Mobile application security experience (iOS and Android)

SDL, automation, and DevSecOps

• Track record implementing SDL processes, tools, and automation in a CI/CD and DevOps environment
• Hands-on experience operating SAST, DAST, SCA, and secrets scanning tools, and tuning them to reduce false positives
• Experience with IaC security (Terraform, CloudFormation) and container security (Docker, Kubernetes)

Cloud and supply chain

• Working knowledge of cloud security in AWS or a comparable provider: IAM, VPC and network segmentation, secrets management, and logging
• Experience in software supply chain security: dependency risk, SBOMs, build integrity, and third-party code governance

Languages and engineering

• Working knowledge of major languages and frameworks (Python, C# / .NET, JavaScript / Node.js, Java) sufficient to review code and write security tooling
• Experience securing large-scale web applications and microservices

Compliance, privacy, and operations

• Familiarity with PCI DSS and with privacy regulations such as GDPR and CCPA as they apply to ecommerce
• Experience running or supporting penetration testing, bug bounty, and security incident response
• Experience defining security metrics and reporting on them

Soft skills

• Excellent problem solving, critical thinking, collaboration, and written and verbal communication

Preferred Qualifications

• Experience with Cloudflare security (WAF, bot management, DDoS protection), AWS networking and compute, and containerized workloads
• Experience securing AI and LLM-enabled applications, including prompt injection, data leakage, and model supply chain risks
• Experience with runtime protection and detection, such as RASP, IAST, or API gateway security controls
• Ability to drive decisions through data, with strong attention to detail and a record of delivering KPIs
• Experience running application security training, security champions programs, and awareness campaigns
• Active contributor to the security community (research, open source, publications, conference talks) with the ability to attract and hire strong talent
• Relevant certifications such as CISSP, CSSLP, OSCP, OSWE, or GIAC (helpful, not required)

#LI-JC1

Compensation :

The expected salary range for this role is $177,000.00 - $225,000.00 USD. The actual base pay offered will be determined by factors such as the candidate's relevant experience, education, geographic location, and internal equity.

If you like wild growth and working with happy, enthusiastic over-achievers, you'll enjoy your career with us!

Staffing Agency Submission Notice iHerb does not accept unsolicited 3rd party ("Agency") candidates. If you are an Agency, please send any requests to be considered as a supplier in our Vendor Management System to staffingvendors@iherb.com. Do not contact iHerb employees directly. If requested to work on a role, any Agency candidates would be presented through the internal recruiting organization.