Senior App Security Engineer - AI-Driven Healthcare (Remote)

Oshi Health; Philadelphia (Philadelphia County); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Salary + equity

Health benefits

Flexible PTO + holidays

401(k)

Remote-first

Job summary

Oshi Health, a fully remote healthcare SaaS platform, seeks a Director of IT & Security to own security architecture, identity and secrets management, and secure AI workflows across AWS. This hands-on role requires 6+ years in security engineering and experience with HIPAA, SOC 2, and NIST CSF.

You will drive threat modeling, secure code reviews, and vendor risk assessments while partnering with product and engineering teams.

Qualifications

• 6+ years in security engineering with application and cloud security focus.
• Experience in healthcare, fintech, or regulated data environments is a plus.
• Familiar with SAST/DAST, secret scanning, and software supply-chain security.
• Knowledge of AI/LLM security, including prompt injection and access controls.
• Able to explain security tradeoffs to engineers and executives.

Responsibilities

• Own security architecture for the SaaS platform and AWS estate.
• Harden identity and secrets management across services.
• Own threat modeling, secure design reviews, and secure code reviews.
• Oversee vulnerability management and pen-testing relationships.
• Ensure compliance with HIPAA SOC 2 and NIST CSF; communicate risks to execs.

Skills

Security engineering

Threat modeling

Cloud security (AWS)

Scripting (Python)

Security governance to executives

Education

Bachelor's degree in Computer Science or equivalent

Tools

GWAPT

GCSA

GCLD

AWS Certified Security – Specialty

CISSP

Okta Certified Professional

GitHub Advanced Security

CodeQL

Job description

Oshi Health, a fully remote healthcare SaaS platform, seeks a Director of IT & Security to own security architecture, identity and secrets management, and secure AI workflows across AWS. This hands-on role requires 6+ years in security engineering and experience with HIPAA, SOC 2, and NIST CSF.

You will drive threat modeling, secure code reviews, and vendor risk assessments while partnering with product and engineering teams.