Senior App Security Engineer (Remote, Equity)

Oshi Health; Nashville (TN); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

401(k) plan

Remote-first

Job summary

Oshi Health is seeking its Director of IT & Security, a hands-on leader responsible for shaping security architecture across a fully remote, cloud-native healthcare platform. You will own application security, threat modeling, and non-human identity management, while ensuring risk-aware decisions for both engineers and executives.

With 6+ years in security engineering and proficiency in IAM, SAST/DAST, and AI/LLM risk management, you will drive security standards across AWS and our CI/CD

Qualifications

• 6+ years in security engineering with depth in application/product security and cloud security (AWS).
• Experience in healthcare, fintech, or other regulated data environments is a strong plus.
• Familiarity with securing AI/LLM and agentic systems: prompt injection, agent authorization, and supply-chain risk.
• Proficient in scripting and automation (Python and at least one shell).

Responsibilities

• Own security architecture for the platform, including IAM, networking, encryption, and workload protection.
• Lead threat modeling, secure design reviews, and secure code reviews for a member-facing app and APIs.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Responsible for vulnerability management and penetration-testing relationships, driving closure and feedback into dev processes.
• Ensure vendor integrations and data flows comply with HIPAA, SOC 2, and NIST CSF requirements.

Skills

Security engineering

Application security

Cloud security (AWS)

SAST/DAST

Code security tooling (CodeQL)

Secrets management

AI/LLM security

Scripting (Python)

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

CodeQL

Job description

Oshi Health is seeking its Director of IT & Security, a hands-on leader responsible for shaping security architecture across a fully remote, cloud-native healthcare platform. You will own application security, threat modeling, and non-human identity management, while ensuring risk-aware decisions for both engineers and executives.

With 6+ years in security engineering and proficiency in IAM, SAST/DAST, and AI/LLM risk management, you will drive security standards across AWS and our CI/CD