Senior Application Security Engineer – Remote & AI‑Enabled

Oshi Health; Columbia (SC); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Salary range: $170,000–$190,000

Health benefits: 90% premiums paid

Flexible PTO + holidays

Remote-first: work from home

Job summary

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security of our fully remote, cloud-native healthcare platform. This hands-on role focuses on security architecture, identity/secrets management, and secure integration into engineering and AI workflows.

You will lead threat modeling, secure design reviews, and secure code review, with emphasis on access-control and secrets exposure risks for our member-facing APIs. Remote-first, with work across AWS.

Qualifications

• 6+ years in security engineering (application/product and cloud).
• Experience with HIPAA, SOC 2, and NIST Cybersecurity Framework.
• Proficient with SAST/DAST, CodeQL, secret scanning, and supply-chain security.
• Familiarity with securing AI/LLM and agentic systems.

Responsibilities

• Own application and product security, including threat modeling and secure code review.
• Design and own security architecture for agentic software development lifecycle.
• Secure AWS environment: IAM, network, logging, encryption, workload protection.
• Enforce security tooling (GitHub Advanced Security, CodeQL, branch protection).
• Review AI and vendor integrations touching PHI for data flows and risk.

Skills

Threat modeling

Secure design & reviews

Risk-based prioritization

Clear communication with engineers & c

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

CodeQL

Secret scanning

AWS

Job description

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security of our fully remote, cloud-native healthcare platform. This hands-on role focuses on security architecture, identity/secrets management, and secure integration into engineering and AI workflows.

You will lead threat modeling, secure design reviews, and secure code review, with emphasis on access-control and secrets exposure risks for our member-facing APIs. Remote-first, with work across AWS.