Senior App Sec Engineer - Cloud & AI Security (Remote)

Oshi Health; Milton (MA); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Remote-first policy

Flexible PTO

Job summary

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security of our fully remote, cloud-native healthcare platform. You will shape security architecture, strengthen identity and secrets management, and embed security into our engineering and AI workflows from day one.

This hands-on role requires collaboration with a small team, ability to prioritize by risk, and fluency with SAST/DAST, IAM, OAuth, and incident response.

Qualifications

• Bachelor's degree or equivalent practical experience.
• 6+ years in security engineering with cloud experience.
• Hands-on with SAST/DAST and GitHub Advanced Security.
• Strong IAM including Okta, OAuth/OIDC, SAML, MFA.
• Familiarity with securing AI/LLM and agentic systems.
• Experience in HIPAA/SOC 2/NIST frameworks.
• Scripting in Python and shell.

Responsibilities

• Own application and product security, including threat modeling and secure design review.
• Design and own security architecture for agentic SDLC and governance.
• Build and run non-human identity and secrets management at scale.
• Secure AWS environment end to end (IAM, network, logging, encryption).
• Enforce security tooling (CodeQL, secret scanning, branch protection).
• Review AI/vendor integrations touching PHI for data flows and DLP.
• Own vulnerability management and pen-testing relationships and remediation.
• Support HIPAA Security Rule safeguards and detection/response automation.

Skills

Scripting

Automation

Security architecture

Threat modeling

Cloud security

Secure SDLC

IAM

Education

Bachelor's degree in CS or equivalent

Tools

GitHub Advanced Security

Job description

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security of our fully remote, cloud-native healthcare platform. You will shape security architecture, strengthen identity and secrets management, and embed security into our engineering and AI workflows from day one.

This hands-on role requires collaboration with a small team, ability to prioritize by risk, and fluency with SAST/DAST, IAM, OAuth, and incident response.