Remote Senior Security Engineer — Apps & Cloud (HIPAA)

Oshi Health; North Carolina; Remote; USD 170.000 - 190.000; Vollzeit

Benefits dieser Stelle

Health benefits

Flexible PTO

401(k)

Remote-first

Zusammenfassung

Oshi Health is hiring a Senior Security Engineer to own the security of our fully remote, cloud-native healthcare platform. You will shape security architecture, harden identity and secrets management, and embed security into engineering and AI workflows from day one.

You will lead threat modeling, secure code reviews, and non-human identity management at scale, collaborating with a small cross-functional team and reporting to the Sr. Director of IT & Security.

Qualifikationen

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with depth in application/product security and cloud security (AWS).
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply‑chain security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and non-human identities and secrets.
• Familiarity with securing AI/LLM and agentic systems: prompt injection, agent authorization, and model risk.
• Comfortable being the sole security specialist on a small, cross-functional team and communicating tradeoffs clearly.
• Working knowledge of HIPAA Security Rule, SOC 2, and NIST Cybersecurity Framework.
• Proficient with scripting and automation (Python and at least one shell).

Aufgaben

• Own application and product security, including threat modeling, secure design review, and secure code review, focusing on access control and secrets-exposure flaws for a healthcare app and its APIs.
• Design and own security architecture for the switch to an agentic software development lifecycle with phase-gate criteria and out-of-band controls.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection.
• Enforce and tune security tooling (GitHub Advanced Security, CodeQL, secret scanning, CODEOWNERS-enforced reviews).
• Review AI and third-party vendor integrations before touching PHI, evaluating data flows, retention, and DLP needs.
• Own vulnerability management and the penetration-testing relationship, driving findings to closure.
• Support HIPAA Security Rule safeguards, stand up detection/response capabilities, and automation for a lean security function.

Kenntnisse

Security engineering

Application security

AWS cloud security

IAM management

Python scripting

OAuth/OIDC

Ausbildung

Bachelor's degree in Computer Science

Tools

GitHub Advanced Security

CodeQL

Terraform

Secret scanning

Jobbeschreibung

Oshi Health is hiring a Senior Security Engineer to own the security of our fully remote, cloud-native healthcare platform. You will shape security architecture, harden identity and secrets management, and embed security into engineering and AI workflows from day one.

You will lead threat modeling, secure code reviews, and non-human identity management at scale, collaborating with a small cross-functional team and reporting to the Sr. Director of IT & Security.