Senior Cloud & AppSec Engineer (Remote)

Oshi Health; United States; Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Remote-first flexibility

Equity participation

Health insurance

Job summary

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security of its remote, cloud-native healthcare platform. You will set architecture standards, harden identity/secrets management, and build security into engineering and AI workflows from the ground up.

You will secure AWS environments, enforce robust security tooling, and drive risk-focused tradeoffs with engineers and executives while ensuring PHI protection and compliance with HIPAA, SOC 2, and NIST CSF.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with demonstrated depth in application/product security and cloud security (AWS).
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and the management of non-human identities and secrets.
• Familiarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk.

Responsibilities

• Own application and product security, including threat modeling, secure design review, and secure code review, with a focus on access-control and secrets-exposure flaws for member-facing apps and APIs.
• Design and own the security architecture for the shift to an agentic SDLC, including phase-gate criteria and tested clawback procedures for risk spikes.
• Build and run non-human identity and secrets management at scale across SaaS and AWS assets.
• Secure our AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform.
• Enforce and tune security tooling to deliver real security outcomes (CodeQL, secret scanning, push protection, branch protection, CODEOWNERS review).
• Review AI and third-party vendor integrations before touching PHI, evaluating data flows, retention, and data loss-prevention needs.

Skills

Security engineering

Application security

Cloud security AWS

IAM

Okta

OAuth/OIDC

SAML

MFA

AI/LLM security

Scripting Python

Code reviews

GitHub Security

HIPAA

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

CodeQL

Secret scanning

Terraform

SAST/DAST tooling

Job description

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security of its remote, cloud-native healthcare platform. You will set architecture standards, harden identity/secrets management, and build security into engineering and AI workflows from the ground up.

You will secure AWS environments, enforce robust security tooling, and drive risk-focused tradeoffs with engineers and executives while ensuring PHI protection and compliance with HIPAA, SOC 2, and NIST CSF.