Senior Security Engineer - Cloud, AI & HIPAA

Oshi Health; Colorado Springs (CO); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

401(k)

Remote-first

Job summary

Oshi Health seeks a Senior Security Engineer to own the security of its fully remote, cloud-native healthcare platform. You’ll lead threat modeling, secure SDLC tooling, and robust IAM across AWS services, while coordinating with a small team to protect PHI and ensure HIPAA/SOC2/NIST compliance.

You will guide non-human identity management, integrate security into AI workflows, and shape security architecture for scalable, trusted software delivery.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with depth in application/product and cloud security (AWS).
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply‑chain security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing‑resistant MFA, and non‑human identities and secrets.
• Familiarity with securing AI/LLM and agentic systems: prompt injection, agent authorization and over‑permissioning, NHI sprawl, and model/supply‑chain risk.
• Comfortable being the sole security specialist on a small, cross‑functional team, prioritizing by risk and explaining tradeoffs to engineers and executives.
• Working knowledge of HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework.
• Proficient with scripting and automation (Python and at least one shell).

Responsibilities

• Own application and product security, including threat modeling and secure code reviews.
• Design and own security architecture for the shift to agentic SDLC and review gates.
• Build and run non-human identity and secrets management at scale.
• Secure the AWS environment end to end (IAM, networking, logging, encryption).
• Enforce and tune security tooling (CodeQL, secret scanning, push protection, CODEOWNERS).
• Review AI and vendor integrations before touching PHI and assess data flows and retention.
• Own vulnerability management and pentesting relationships, driving fixes into development.
• Support HIPAA Security Rule safeguards and build detection/response capabilities.

Skills

Security engineering

AWS security

SAST/DAST

CodeQL

Identity & access management

Python scripting

AI/LLM security

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

Okta

Terraform

Job description

Oshi Health seeks a Senior Security Engineer to own the security of its fully remote, cloud-native healthcare platform. You’ll lead threat modeling, secure SDLC tooling, and robust IAM across AWS services, while coordinating with a small team to protect PHI and ensure HIPAA/SOC2/NIST compliance.

You will guide non-human identity management, integrate security into AI workflows, and shape security architecture for scalable, trusted software delivery.