Remote Senior App Security Architect

Oshi Health; Nashville (TN); À distance; USD 170 000 - 190 000; Plein temps

Avantages offerts par ce poste

Health benefits 90% premiums covered

Remote-first flexibility

Equity and bonus potential

Flexible PTO and holidays

Résumé du poste

Oshi Health seeks a Senior Security Engineer to own the security of its fully remote, cloud-native healthcare platform. You will build and enforce security architecture, manage non-human identities, and harden secure SDLC practices across engineering and AI workflows.

Your work will cover AWS security, IAM, secret management, threat modeling, and integration reviews to protect PHI while enabling rapid product innovation. A hands-on, builder mindset is essential.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with depth in application/product security and cloud security (AWS).
• Experience in healthcare, fintech, or a regulated data-sensitive environment is a plus.
• Hands-on with SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain security.
• Strong in identity and access management including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and non-human identities management.
• Familiarity with securing AI/LLM and agentic systems, including prompt injection, agent authorization, and model risk.
• Comfortable as the sole security specialist on a small team and able to explain trade-offs to engineers and executives.
• Knowledge of HIPAA Security Rule, SOC 2, and NIST CSF.
• Proficiency in Python and at least one shell language.
• Certifications such as OSCP, GIAC, CISSP, AWS Certified Security – Specialty, or Okta CP are a plus.
• Experience operating a compliance-automation platform.

Responsabilités

• Own application and product security including threat modeling, secure design review, and secure code review focusing on access-control and secrets exposure issues.
• Design and own security architecture for the shift to an agentic SDLC with phase-gate criteria and robust controls.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure AWS environment end-to-end including IAM, VPC segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform.
• Enforce and tune security tooling like GitHub Advanced Security, CodeQL, secret scanning, branch protection, and CODEOWNERS enforcement.
• Review AI and third-party integrations for PHI handling, data flows, retention, and data loss prevention considerations.
• Own vulnerability management and penetration testing relationships and drive findings to closure.
• Support HIPAA Security Rule safeguards, detection and response capabilities, and automation for small security teams.

Connaissances

Application security

Cloud security (AWS)

IAM / MFA / Okta

SAST/DAST & CodeQL

Secrets management

AI/LLM security

Security communication

Formation

Bachelor's degree in Computer Science or equivalent

Outils

AWS

CodeQL

GitHub Advanced Security

Terraform

SAML/OAuth

Description du poste

Oshi Health seeks a Senior Security Engineer to own the security of its fully remote, cloud-native healthcare platform. You will build and enforce security architecture, manage non-human identities, and harden secure SDLC practices across engineering and AI workflows.

Your work will cover AWS security, IAM, secret management, threat modeling, and integration reviews to protect PHI while enabling rapid product innovation. A hands-on, builder mindset is essential.