Senior Product Security Engineer - AI & AppSec

The Briefed; Los Angeles (CA); Ibrido; USD 164.000 - 215.000; Tempo pieno

Vantaggi offerti da questo lavoro

Hybrid schedule

Equity grants

Annual performance bonus

Unlimited vacation

Health coverage

401(k)

Parental leave

Wellness reimbursements

Descrizione del lavoro

Oscar is seeking a Senior Product Security Engineer 1 to lead security across the SDLC, including AI-driven workflows, in Los Angeles. You will secure development "paved roads", architect defensive systems, and design security frameworks for AI agent workflows that bypass traditional ticketing channels.

With 4+ years of combined software engineering and security, you will secure code, review changes, and mentor junior engineers while ensuring compliance with healthcare regulations and industry

Competenze

• 4+ years combined experience in software engineering and application/information security.
• Hands-on experience securing all stages of the Secure Software Development Life Cycle (SDLC).
• Proven track record of architecting and building moderate-to-complex standalone systems or major platform security features.
• Practical experience utilizing AI models and integrating them with internal engineering systems via MCP or APIs.

Mansioni

• Vulnerability Lifecycle Management: Drive end-to-end vulnerability management lifecycle with SAST/DAST tooling and manual code analysis.
• AI Integration & Security: Design security measures for AI-driven workflows and agent integration (MCP).
• Architecture & Secure SDLC: Partner with engineering to architect, build, test, and deploy secure infra, auth systems, and libraries.
• Source Code Review & Development: Conduct reviews across codebases and write production-ready security libraries for developers.
• Risk Assessment & Mentorship: Build risk frameworks and mentor junior security engineers.
• Engineering Enablement: Deliver security briefings, advise on remediation, ensure healthcare regulatory compliance.

Conoscenze

Vulnerability lifecyle mgmt

AI security integration

Secure SDLC

Source code review

Mentorship

Formazione

Bachelor’s degree in CS/Cybersecurity or 4 years of equivalent

Descrizione del lavoro

Oscar is the first health insurance company built around a full-stack technology platform, driven by a mission to make healthcare simple, accessible, and member-focused.

As a Senior Product Security Engineer 1, you will serve as a key technical leader securing Oscar’s software development life cycle (SDLC) from design through production deployment. Working at the intersection of traditional application security and modern AI-driven engineering, you will secure development "paved roads," architect defensive systems, and design security frameworks for AI agent workflows that bypass traditional ticketing channels.

Key Responsibilities

• Vulnerability Lifecycle Management: Drive the end-to-end vulnerability management lifecycle—combining automated SAST/DAST tooling with manual code analysis and remediation tracking.
• AI Integration & Security: Design and implement security measures for AI-driven workflows and agent integration, including protocols like the Model Context Protocol (MCP).
• Architecture & Secure SDLC: Partner with core engineering to architect, build, test, and deploy secure application infrastructure, authentication systems, and security libraries.
• Source Code Review & Development: Conduct manual and automated source code reviews across internal and third-party codebases, while writing production-ready security libraries for developer use.
• Risk Assessment & Mentorship: Build actionable risk assessment frameworks for complex engineering initiatives while providing technical mentorship to junior security engineers.
• Engineering Enablement: Deliver technical security presentations, advise engineering teams on vulnerability remediation, and ensure compliance with healthcare regulations.

Requirements

Experience & Technical Background

• 4+ years of combined professional experience in software engineering and application/information security.
• Demonstrated hands-on experience securing all stages of the Secure Software Development Life Cycle (SDLC).
• Proven track record of architecting and building moderate-to-complex standalone systems or major platform security features.
• Practical experience utilizing AI models and integrating them with internal engineering systems via protocols like the Model Context Protocol (MCP) or custom APIs.

Mindset & Soft Skills

• Ability to simplify intricate security concerns into clear, actionable technical requirements for engineering teams.
• Strong technical leadership, collaboration, and mentorship capabilities.

Bonus Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, or 4 years of equivalent practical experience.
• Prior experience with healthcare data compliance (HIPAA, HITRUST) or domain knowledge of health insurance technology challenges.

Workplace Model & Benefits

• Hybrid Schedule: 3 days/week in the Los Angeles, CA office (Thursdays required for team meetings; 2 flexible days).
• Total Compensation: Base salary ($163,944 – $215,176/yr) + company equity grants + annual performance bonus.
• Benefits: Unlimited vacation program, medical/dental/vision coverage, 401(k), paid parental leave, paid holidays, and wellness reimbursements.