Senior App Security Architect - Remote/AWS & AI

Oshi Health; Central City (CO); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

401(k) matching

Remote-first culture

Job summary

Oshi Health, a fully remote healthcare platform, seeks a Director of IT & Security to own security architecture, identity and secrets management, and secure coding practices across AWS and SaaS environments.

You will lead threat modeling, secure design and code reviews, manage vulnerability cycles, and align with HIPAA, SOC 2, and NIST frameworks while balancing ambitious AI-enabled product development.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• ~6+ years in security engineering, with depth in application/product security and cloud security (AWS).
• Experience with SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain security.
• Familiarity with securing AI/LLM and agentic systems: prompt injection, agent authorization, over-permissioning.

Responsibilities

• Own security architecture across AWS and SaaS environments, including identity and secrets management.
• Lead threat modeling, secure design reviews, and secure code reviews.
• Drive vulnerability management and coordinate with development teams to close findings.
• Ensure compliance with HIPAA, SOC 2, and NIST Cybersecurity Framework.

Skills

Security engineering

Application security

Cloud security (AWS)

Scripting (Python)

Threat modeling

HIPAA/SOC 2/NIST knowledge

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

CodeQL

Secret scanning

Software supply-chain security

Job description

Oshi Health, a fully remote healthcare platform, seeks a Director of IT & Security to own security architecture, identity and secrets management, and secure coding practices across AWS and SaaS environments.

You will lead threat modeling, secure design and code reviews, manage vulnerability cycles, and align with HIPAA, SOC 2, and NIST frameworks while balancing ambitious AI-enabled product development.