Senior Product Security Engineer - AI-Driven SDLC Leader

Oscar Health, Inc.; Los Angeles (CA); Hybrid; USD 164,000 - 215,000; Full time

Benefits offered by this job

Employee benefits

Unlimited vacation program

Company equity

Annual performance bonuses

Job summary

Oscar Health, Inc. in Los Angeles is hiring a Senior Product Security Engineer 1 to lead security across the SDLC, marrying traditional app security with AI-driven engineering.

You will secure the architecture, design security controls for AI workflows, review code, mentor junior engineers, and partner with the engineering teams to remediate vulnerabilities. This hybrid role requires 3 in-office days/week (Thursdays required).

Qualifications

• 4+ years of combined career experience in software development and information security.
• Proven experience across all areas of the Secure Software Development Life Cycle.
• Strong background in building moderate to complex standalone systems or major new features.
• Hands-on experience using AI models and integrating them with internal systems via MCP.

Responsibilities

• Drive the vulnerability management lifecycle, from automated identification (SAST/DAST) to remediation tracking.
• Mentor junior engineers and improve workflows.
• Conduct source code reviews and write production-quality code and libraries.
• Build risk assessment frameworks and deliver actionable plans.
• Guide Engineering teams for remediation or migration of vulnerabilities and present security topics.
• Ensure compliance with all laws and regulations.
• Other duties as assigned.

Skills

SDLC experience

Secure SDLC

System development

AI integration

Education

Bachelor's degree or equivalent experience

Job description

Oscar Health, Inc. in Los Angeles is hiring a Senior Product Security Engineer 1 to lead security across the SDLC, marrying traditional app security with AI-driven engineering.

You will secure the architecture, design security controls for AI workflows, review code, mentor junior engineers, and partner with the engineering teams to remediate vulnerabilities. This hybrid role requires 3 in-office days/week (Thursdays required).