Remote Senior Security Engineer — HIPAA-Ready Cloud

Oshi Health; United States; Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

401(k)

Remote‑first work

Job summary

Oshi Health is seeking a Senior Security Engineer to own the security of our remote healthcare platform. You’ll lead threat modeling, secure design, and non-human identity management, while shaping security architecture across our SaaS and AWS stack.

You will collaborate with engineers and executives to balance risk, implement robust IAM, integrate GitHub Advanced Security, and guide vendor risk assessments, all within a remote-first, US-wide hiring scope.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with depth in application/product security and cloud security (AWS).
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply‑chain security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, MFA, and non-human identities management.
• Familiarity with securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning.
• Comfortable being the sole security specialist on a small team and communicating tradeoffs clearly.
• Working knowledge of HIPAA Security Rule, SOC 2, and NIST CSF.
• Proficient with scripting and automation (Python and shell).

Responsibilities

• Own application and product security, including threat modeling and secure design review.
• Design and own security architecture for the agentic software lifecycle and phase-gate criteria.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure AWS environment end to end: IAM, network segmentation, logging, encryption, workload protection (S3, EKS, Terraform).
• Enforce and tune security tooling (GitHub Advanced Security, CodeQL, secret scanning, branch protection).
• Review AI and third‑party vendor integrations touching PHI for data flows and DLP needs.
• Own vulnerability management and penetration testing relationship; drive findings to closure.
• Support HIPAA Security Rule technical safeguards, detection/response capabilities, automation.

Skills

Security engineering

Cloud security (AWS)

SAST/DAST tooling

Identity and access management

AI/LLM security

HIPAA/SOC 2/NIST familiarity

Scripting (Python, shell)

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

CodeQL

Secret scanning

Terraform

Job description

Oshi Health is seeking a Senior Security Engineer to own the security of our remote healthcare platform. You’ll lead threat modeling, secure design, and non-human identity management, while shaping security architecture across our SaaS and AWS stack.

You will collaborate with engineers and executives to balance risk, implement robust IAM, integrate GitHub Advanced Security, and guide vendor risk assessments, all within a remote-first, US-wide hiring scope.