Senior AppSec Engineer - Cloud & HIPAA (Remote)

Oshi Health; Annapolis (MD); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

401(k)

Remote-first

Job summary

Oshi Health is seeking a Senior Security Engineer to own the security of a remote-first, cloud-native healthcare platform. You will design security architecture, hardened IAM and secrets management, and integrate security into engineering and AI workflows from day one.

You will lead threat modeling, secure design reviews, and secure code practices across AWS, S3, EKS, Terraform, and your tooling stack, including GitHub Advanced Security, CodeQL, and vendor risk reviews, in a fast-growing team.

Qualifications

• Required Bachelor’s degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with depth in application/product security and cloud security (AWS).
• Experience in healthcare, fintech, or another regulated data-sensitive environment is a strong plus.
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, MFA, and non-human identities management.
• Familiarity with securing AI/LLM and agentic systems: prompt injection, agent authorization, and risk management.
• Comfortable being the sole security specialist on a small, cross-functional team and explaining tradeoffs to engineers and executives.
• Working knowledge of HIPAA Security Rule, SOC 2, and NIST Cybersecurity Framework.
• Proficient with scripting and automation (Python and at least one shell).
• Preferred certifications: OSCP, GIAC (e.g., GWAPT, GCSA, GCLD), AWS Certified Security – Specialty, CISSP, or Okta Certified Professional.
• Experience operating a compliance-automation platform.

Responsibilities

• Own application and product security with threat modeling, secure design reviews, and secure code reviews.
• Design and own security architecture for shift to an agentic software development lifecycle.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection.
• Enforce and tune security tooling like GitHub Advanced Security, CodeQL, and CODEOWNERS-enforced reviews.
• Review AI and third-party vendor integrations before touching PHI, evaluating data flows and retention.
• Own vulnerability management and penetration-testing relationships and drive findings to closure.
• Support HIPAA Security Rule technical safeguards and build automation for a small security function.

Skills

Security engineering

Application security

Cloud security

Identity & IAM

Scripting Python

OAuth/OIDC

Threat modeling

SAST/DAST

HIPAA/Compliance

Education

Bachelor's degree in Computer Science

Tools

GitHub Advanced Security

CodeQL

Secret scanning

Software supply-chain security

Job description

Oshi Health is seeking a Senior Security Engineer to own the security of a remote-first, cloud-native healthcare platform. You will design security architecture, hardened IAM and secrets management, and integrate security into engineering and AI workflows from day one.

You will lead threat modeling, secure design reviews, and secure code practices across AWS, S3, EKS, Terraform, and your tooling stack, including GitHub Advanced Security, CodeQL, and vendor risk reviews, in a fast-growing team.