Remote Senior Application Security Engineer

Oshi Health; Tennessee; Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

401(k) plan

Flexible PTO

Holidays

Remote-first

Job summary

Oshi Health is seeking its first dedicated Director of IT & Security to own the security of our remote, cloud-native healthcare platform. You will build security into engineering and AI workflows, design secure architectures, and manage identity/secrets at scale across AWS.

You will lead threat modeling, secure design reviews, and secure code reviews, ensuring access-control and secrets-exposure issues are mitigated for our member-facing app and APIs.

Qualifications

• 6+ years in security engineering with emphasis on application/product and cloud security.
• Experience with SAST/DAST, CodeQL, secret scanning, and software supply-chain security.
• Familiarity with AI/LLM security risks and agentic systems.
• Ability to justify security tradeoffs to engineers and executives.
• Knowledge of HIPAA Security Rule, SOC 2, and NIST CSF is a plus.
• Proficient in scripting and automation (Python and shell).

Responsibilities

• Own security across the SaaS platform, APIs, and product features.
• Set security architecture standards and enforce identity/secrets controls.
• Drive vulnerability management, pen-testing partnerships, and remediation.
• Secure AWS estate end-to-end: IAM, networking, logging, encryption.
• Integrate security into CI/CD, AI workflows, and vendor integrations.

Skills

SAST/DAST

CodeQL / GitHub Advanced Security

Secret scanning

Supply-chain security

Python scripting

Azure / AWS security

Education

Bachelor's degree or equivalent

Tools

Terraform

AWS

Job description

Oshi Health is seeking its first dedicated Director of IT & Security to own the security of our remote, cloud-native healthcare platform. You will build security into engineering and AI workflows, design secure architectures, and manage identity/secrets at scale across AWS.

You will lead threat modeling, secure design reviews, and secure code reviews, ensuring access-control and secrets-exposure issues are mitigated for our member-facing app and APIs.