Senior AppSec Engineer | Remote, Cloud & AI Security

Oshi Health; Missouri; Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Remote-first work model

401(k)

Job summary

Oshi Health is seeking its Director of IT & Security to own the security of a remote-first SaaS healthcare platform. You will set architecture standards, harden identity and secrets management, and embed secure practices into engineering and AI workflows from the ground up.

You will lead application and product security efforts, including threat modeling, secure review processes, and preventative controls for PHI protection, while coordinating vulnerability management and vendor risk.

Qualifications

• 6+ years in security engineering with depth in application/product and cloud security
• Experience with SAST/DAST and GitHub Advanced Security/CodeQL
• Familiarity with securing AI/LLM and agentic systems (prompt injection, authorization, risk)
• Able to be the sole security specialist on a small cross-functional team and explain tradeoffs clearly
• Knowledge of HIPAA Security Rule, SOC 2, and NIST CSF
• Proficient in scripting and automation (Python and at least one shell)

Responsibilities

• Own security architecture standards and identity/secrets management
• Oversee threat modeling, secure design reviews, and secure code reviews
• Manage vulnerability, penetration testing relationships and remediation cycles

Skills

Security engineering

Cloud security

Threat modeling

SAST/DAST

Python scripting

Communication skills

Education

Bachelor's degree in CS or equivalent

Tools

GitHub Advanced Security/CodeQL

Secret scanning

Compliance automation platform

AWS IAM

Job description

Oshi Health is seeking its Director of IT & Security to own the security of a remote-first SaaS healthcare platform. You will set architecture standards, harden identity and secrets management, and embed secure practices into engineering and AI workflows from the ground up.

You will lead application and product security efforts, including threat modeling, secure review processes, and preventative controls for PHI protection, while coordinating vulnerability management and vendor risk.