Senior Application Security Architect — Remote

Oshi Health; Colorado Springs (CO); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Bonus

Equity

Remote-first

Health benefits

Job summary

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security architecture of our remote, cloud-native healthcare platform. You will drive threat modeling, secure design, and secure code reviews for a member-facing app and APIs, with a focus on access control and secrets management across our SaaS and AWS estate.

The role emphasizes hands-on security for developers, including non-human identity management, CI/CD security, and engagement with regulators.

Qualifications

• 6+ years in security engineering with depth in application/product and cloud security (AWS)
• Experience with SAST/DAST and software supply-chain security tools
• Familiarity with securing AI/LLM and agentic systems and risk management
• Comfort as sole security specialist on a small, cross-functional team and ability to explain tradeoffs to engineers/executives

Responsibilities

• Own security architecture and phase-gate criteria for the product
• Lead threat modeling, secure design reviews, and secure code reviews
• Secure our AWS environment including IAM, networking, and logging
• Oversee vulnerability management and penetration-testing relationships

Skills

Security engineering

Application security

Cloud security AWS

SAST/DAST

GitHub Advanced Security

Python scripting

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

CodeQL

Terraform

AWS

Job description

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security architecture of our remote, cloud-native healthcare platform. You will drive threat modeling, secure design, and secure code reviews for a member-facing app and APIs, with a focus on access control and secrets management across our SaaS and AWS estate.

The role emphasizes hands-on security for developers, including non-human identity management, CI/CD security, and engagement with regulators.