Senior App Security Engineer: Cloud, AI, Remote

Oshi Health; Portland (ME); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Salary range: $170,000–$190,000

Remote-first

Health benefits

401(k)

Meaningful equity

Job summary

Oshi Health seeks a Director of IT & Security to own the security of its remote, cloud-native healthcare platform. You will shape security architecture, tighten identity and secrets management, and embed security into engineering and AI workflows from day one.

You will lead threat modeling, secure design reviews, and code reviews with a focus on access control and data protection. A strong background in cloud security (AWS) and healthcare data compliance is required.

Qualifications

• 6+ years in security engineering with depth in application/product and cloud security (AWS).
• Experience with SAST/DAST, secret scanning, and software supply-chain security.
• Familiarity with HIPAA Security Rule, SOC 2, and NIST CSF.
• Experience securing AI/LLM and agentic systems: prompt injection, agent authorization, and model risk.
• Able to be the sole security expert on a small cross-functional team and communicate tradeoffs clearly to engineers and executives.

Responsibilities

• Own security architecture and build security into engineering and AI workflows.
• Conduct threat modeling, secure design reviews, and secure code reviews focusing on access-control and secrets exposure.
• Design and own security architecture for agentic SDLC including phase-gate criteria and clawback procedures.
• Manage non-human identity and secrets across SaaS and AWS environments.
• Oversee vulnerability management, penetration testing relationships, and audit vendor security for PHI flows.

Skills

Security engineering

Cloud security (AWS)

Application security

Scripting (Python)

Threat modeling

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security/CodeQL

AWS

Job description

Oshi Health seeks a Director of IT & Security to own the security of its remote, cloud-native healthcare platform. You will shape security architecture, tighten identity and secrets management, and embed security into engineering and AI workflows from day one.

You will lead threat modeling, secure design reviews, and code reviews with a focus on access control and data protection. A strong background in cloud security (AWS) and healthcare data compliance is required.