Senior Cloud & App Security Engineer (Remote)

Oshi Health; Boston (MA); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Remote-first

Flexible PTO

401(k) eligibility

Equity

Job summary

Oshi Health is seeking a Senior Security Engineer to own the security of its fully remote, SaaS and cloud-native healthcare platform. You will set security standards, harden identity/secrets, and integrate security into engineering and AI workflows from the start.

You will lead threat modeling, secure design reviews, and secure code reviews, focusing on healthcare APIs and data protection, while collaborating with a cross-functional team in a remote-first environment.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with deep focus on application/product security and cloud security (AWS).
• Healthcare, fintech, or another regulated, data-sensitive environment experience is a plus.
• Hands-on with SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain security.
• Identity and access management including Okta, OAuth/OIDC, SAML, MFA, and non-human identities/secrets management.
• Experience securing AI/LLM and agentic systems: prompt injection, agent authorization, risk assessment.

Responsibilities

• Own application and product security, including threat modeling and secure design/code reviews for healthcare app and APIs.
• Design and own security architecture for agentic software development lifecycle with phase-gate criteria and clawback procedures.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure AWS environment end-to-end: IAM, network segmentation, logging, encryption, workload protection (S3, EKS, Terraform).
• Enforce and tune security tooling: GitHub Advanced Security/CodeQL, secret scanning, branch protection, CODEOWNERS enforced reviews.
• Review AI and third-party vendor integrations touching PHI, evaluate data flows, retention, DLP needs.
• Own vulnerability management and penetration testing relationships; drive findings to closure.
• Support HIPAA Security Rule technical safeguards; stand up detection/response capabilities; automate security operations.

Skills

Security engineering

Application security

AWS security

Identity & access management

Scripting - Python

AI/LLM security

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

CodeQL

Secret scanning

Terraform

Okta

Job description

Oshi Health is seeking a Senior Security Engineer to own the security of its fully remote, SaaS and cloud-native healthcare platform. You will set security standards, harden identity/secrets, and integrate security into engineering and AI workflows from the start.

You will lead threat modeling, secure design reviews, and secure code reviews, focusing on healthcare APIs and data protection, while collaborating with a cross-functional team in a remote-first environment.