Senior Cloud Security Engineer - Remote (HIPAA)

Oshi Health; Saint Paul (MN); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Remote-first

Paid time off

Job summary

Oshi Health seeks a Senior Security Engineer to own the security of its remote, cloud-native healthcare platform. You will harden identity and secrets, set security standards, and embed security into CI/CD and AI workflows from day one.

This hands-on role requires securing AWS environments, implementing SAST/DAST, and conducting vendor risk reviews, while maintaining HIPAA, SOC 2, and NIST-aligned practices for PHI protection.

Qualifications

• Bachelor's degree in CS or equivalent practical experience.
• 6+ years in security engineering with cloud security (AWS).
• Hands-on with secure SDLC tooling and identity management.
• Experience securing AI/LLM and agentic systems is a plus.

Responsibilities

• Own application and product security with focus on access-control and secrets exposure.
• Design security architecture for agentic SDLC and risk controls.
• Build and run non-human identity and secrets management.
• Secure AWS environment including IAM, segmentation, logging, encryption.
• Enforce security tooling like CodeQL, branch protection, CODEOWNERS.

Skills

Security engineering

Application security

Cloud security (AWS)

Identity & access management

Scripting (Python)

Executive communication

Education

Bachelor's degree in Computer Science or equivalent

OSCP

GIAC GWAPT/GCSA/GCLD

AWS Certified Security – Specialty

CISSP

Okta Certified Professional

Tools

GitHub Advanced Security/CodeQL

SAST/DAST tooling

Secret scanning tools

AWS services (IAM, S3, EKS, Terraform)

Terraform

Job description

Oshi Health seeks a Senior Security Engineer to own the security of its remote, cloud-native healthcare platform. You will harden identity and secrets, set security standards, and embed security into CI/CD and AI workflows from day one.

This hands-on role requires securing AWS environments, implementing SAST/DAST, and conducting vendor risk reviews, while maintaining HIPAA, SOC 2, and NIST-aligned practices for PHI protection.