Senior Cloud & App Security Engineer — Remote

Oshi Health; Columbia (SC); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Remote-first flexibility

401(k) participation

Job summary

Oshi Health is hiring a Senior Security Engineer to own the security of our remote-first, cloud-native healthcare platform. You will set security architecture standards, harden identity and secrets management, and integrate security into our engineering and AI workflows from day one.

As the sole security specialist on a small cross-functional team, you’ll drive threat modeling, secure SDLC tooling, and compliance with HIPAA, SOC 2, and NIST, while partnering with engineers and executives to

Qualifications

• Required Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering, with demonstrated depth in application/product security and cloud security (AWS).
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and the management of non-human identities and secrets.
• Familiarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk.
• Comfortable being the sole security specialist on a small, cross-functional team, prioritizing ruthlessly by risk and able to explain a tradeoff clearly to both engineers and non-technical executives.
• Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework.
• Proficient with scripting and automation (Python and at least one shell).
• PreferredOne or more certifications: OSCP, GIAC (e.g., GWAPT, GCSA, GCLD), AWS Certified Security – Specialty, CISSP, or Okta Certified Professional.
• Experience operating a compliance-automation platform.

Responsibilities

• Own application and product security, including threat modeling, secure design review, and secure code review, with a focus on access-control and secrets-exposure flaws for a healthcare app and its APIs.
• Design and own the security architecture for a shift to an agentic SDLC, including phase-gate criteria and tested clawback procedures.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure our AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform.
• Enforce and tune security tooling like GitHub Advanced Security, CodeQL, secret scanning, branch protection, and CODEOWNERS enforcement.
• Review AI and third-party vendor integrations before they touch PHI, evaluating data flows, retention, and data loss-prevention needs.
• Own vulnerability management and the penetration-testing relationship, driving findings to closure and feeding recurring issues back into development.
• Support HIPAA Security Rule technical safeguards, stand up detection and response capabilities, and build automation for a nimble security function.

Skills

Security engineering

Application security

Cloud security (AWS)

Identity & access management

Scripting (Python)

Education

Bachelor's degree in Computer Science or equivalent practical experience

Tools

GitHub Advanced Security

CodeQL

Secret scanning

SAST/DAST

Job description

Oshi Health is hiring a Senior Security Engineer to own the security of our remote-first, cloud-native healthcare platform. You will set security architecture standards, harden identity and secrets management, and integrate security into our engineering and AI workflows from day one.

As the sole security specialist on a small cross-functional team, you’ll drive threat modeling, secure SDLC tooling, and compliance with HIPAA, SOC 2, and NIST, while partnering with engineers and executives to