Senior App Security Engineer — Remote, HIPAA-ready

Oshi Health; Kansas City (MO); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Bonus and meaningful equity

Health benefits

Flexible PTO

401(k)

Remote-first with US states coverage

Job summary

Oshi Health seeks a Senior Security Engineer to own the security of a fully remote, cloud-native healthcare platform. You’ll set security standards, harden identity and secrets, and integrate security into AI-enabled development from day one, shaping a scalable security posture.

You will lead threat modeling, secure design reviews, and rapid remediation across AWS, SSO, and CI/CD pipelines while partnering with engineering and product teams.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with application/product and cloud security (AWS).
• Experience in healthcare/regulated environments is a strong plus.
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning.
• Strong in identity and access management including Okta, OAuth/OIDC, SAML, MFA.

Responsibilities

• Own application and product security, including threat modeling and secure code reviews.
• Design security architecture for agentic software development lifecycle with phase-gate criteria.
• Build and run non-human identity and secrets management at scale.
• Secure AWS environment end to end: IAM, networking, logging, encryption, and workload protection.
• Enforce tooling: CodeQL, secret scanning, branch protection, and CODEOWNERS enforcement.
• Review AI/3rd-party integrations for PHI data flows and data-loss prevention needs.

Skills

Security engineering

Application security

Cloud security (AWS)

IAM / Access management

Scripting (Python)

Education

Bachelor's degree in CS or equivalent

Tools

GitHub Advanced Security

CodeQL

Secret scanning

Terraform

AWS tooling

Job description

Oshi Health seeks a Senior Security Engineer to own the security of a fully remote, cloud-native healthcare platform. You’ll set security standards, harden identity and secrets, and integrate security into AI-enabled development from day one, shaping a scalable security posture.

You will lead threat modeling, secure design reviews, and rapid remediation across AWS, SSO, and CI/CD pipelines while partnering with engineering and product teams.