Remote Senior Security Architect – App & Cloud (Equity)

Oshi Health; Columbus (OH); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Remote-first

Flexible PTO

401(k)

Job summary

Oshi Health seeks a Senior Security Engineer to own security for its fully remote, cloud-native healthcare platform. You will set security architecture standards, harden identity and secrets management, and integrate security into engineering and AI workflows from the start.

You will lead threat modeling, secure design reviews, and secure coding practices, covering IAM, data protection, and vendor risk. This is a hands-on role in a small, cross-functional team requiring clear risk tradeoffs and

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering, with depth in application/product security and cloud security (AWS).
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and non-human identities and secrets.
• Familiarity with securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permutation, NHI sprawl, and model/supply-chain risk.
• Comfortable being the sole security specialist on a small cross-functional team, able to explain tradeoffs to engineers and executives.
• Working knowledge of HIPAA Security Rule, SOC 2, and NIST Cybersecurity Framework.
• Proficient with scripting and automation (Python and at least one shell).
• One or more certifications: OSCP, GIAC, AWS Certified Security – Specialty, CISSP, or Okta Certified Professional.
• Experience operating a compliance-automation platform.

Responsibilities

• Own application and product security, including threat modeling, secure design review, and secure code review with a focus on access-control and secrets exposure flaws.
• Design and own the security architecture for the shift to an agentic software development lifecycle.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure the AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection.
• Enforce and tune security tooling (GitHub Advanced Security, CodeQL, secret scanning, branch protection, CODEOWNERS).
• Review AI and third-party vendor integrations before they touch PHI; evaluate data flows, retention and DLP needs.
• Own vulnerability management and the penetration-testing relationship; drive findings to closure.
• Support HIPAA Security Rule technical safeguards, stand up detection and response capabilities, and automation for a lean security function.

Skills

Security engineering

IAM

Threat modeling

Secure SDLC tooling

Python scripting

AWS security

Education

Bachelor's degree in CS or equivalent

Tools

GitHub Advanced Security

CodeQL

Secret scanning

SAST/DAST

AWS IAM

Job description

Oshi Health seeks a Senior Security Engineer to own security for its fully remote, cloud-native healthcare platform. You will set security architecture standards, harden identity and secrets management, and integrate security into engineering and AI workflows from the start.

You will lead threat modeling, secure design reviews, and secure coding practices, covering IAM, data protection, and vendor risk. This is a hands-on role in a small, cross-functional team requiring clear risk tradeoffs and