Senior Application Security Engineer (Remote)

Oshi Health; Montpelier (VT); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Remote-first workforce

Flexible PTO

Job summary

Oshi Health seeks a Senior Security Engineer to own the security of its fully remote, cloud-native healthcare platform. You will set security architecture standards, harden identity and secrets management, and embed security into engineering and AI workflows from the start with a hands-on, builder-focused approach.

You will lead threat modeling, secure design reviews, IAM, data protection and risk-based decisions while collaborating with a small cross-functional team.

Qualifications

• Bachelor's degree or equivalent practical experience in a technical field.
• 6+ years of security engineering with focus on application and cloud security (AWS).
• Experience in regulated environments such as healthcare or fintech is a strong plus.
• Hands-on with SDLC tooling: SAST/DAST, CodeQL, secret scanning, and supply-chain security.
• Strong IAM expertise including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and non-human identities.
• Comfort with securing AI/LLM and agentic systems and communicating tradeoffs clearly.
• Experience in HIPAA SOC 2 and NIST CSF familiarity; scripting in Python and shell.

Responsibilities

• Own application and product security, including threat modeling, secure design reviews, and secure code reviews.
• Design and own security architecture for a shift to agentic software development lifecycle.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure AWS environment end to end: IAM, network segmentation, logging, encryption, workload protection.
• Enforce and tune security tooling (CodeQL, secret scanning, branch protection, CODEOWNERS).
• Review AI and third-party vendor integrations touching PHI; evaluate data flows and DLP needs.
• Own vulnerability management and penetration-testing relationships; drive findings to closure.
• Support HIPAA Security Rule safeguards and stand up detection/response capabilities.

Skills

Security engineering

Application security

Cloud security (AWS)

SAST/DAST

Identity and access management

AI/LLM security

Scripting (Python)

Education

Bachelor's degree in Computer Science

Tools

GitHub Advanced Security

CodeQL

Secrets management tooling

Terraform

Job description

Oshi Health seeks a Senior Security Engineer to own the security of its fully remote, cloud-native healthcare platform. You will set security architecture standards, harden identity and secrets management, and embed security into engineering and AI workflows from the start with a hands-on, builder-focused approach.

You will lead threat modeling, secure design reviews, IAM, data protection and risk-based decisions while collaborating with a small cross-functional team.