Senior Security Engineer – Cloud, AI & HIPAA (Remote)

Oshi Health; Salem (OR); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

11 holidays + floating holiday

Remote-first/work from home

401(k)

Job summary

Oshi Health seeks a Senior Security Engineer to own the security of its fully remote, cloud-native healthcare platform. You will shape security architecture, manage non-human identities, and harden workflows as AI-driven development expands. This is a hands-on, builder-focused role with broad scope across security controls.

You will lead threat modeling, secure design reviews, and secure code practices, while collaborating with engineering to balance risk and product delivery.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with depth in application/product and cloud security (AWS).
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply‑chain security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, MFA, and non-human identities and secrets.
• Experience securing AI/LLM and agentic systems: prompt injection, agent authorization, and risk management.
• Comfortable being the sole security specialist on a small team and communicating tradeoffs clearly.
• Familiarity with HIPAA Security Rule, SOC 2, and NIST Cybersecurity Framework.
• Proficient with scripting and automation (Python and at least one shell).

Responsibilities

• Own application and product security, with focus on access-control and secrets-exposure flaws for member-facing apps and APIs.
• Design and own security architecture for agentic SDLC, including phase-gate criteria and out-of-band controls.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure our AWS environment end-to-end: IAM, network segmentation, logging, encryption, workload protection (S3, EKS, Terraform).
• Enforce and tune security tooling: GitHub Advanced Security, CodeQL, secret scanning, branch protection, CODEOWNERS enforcement.
• Review AI and third-party vendor integrations before touching PHI, evaluating data flows and DLP needs.
• Own vulnerability management and penetration-testing relationship, driving findings to closure.
• Support HIPAA Security Rule safeguards, stand up detection/response capabilities, and build automation.

Skills

Security engineering

Identity & access management

Secure SDLC tooling

Cloud security (AWS)

Python scripting

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

CodeQL

Secret scanning

SAST/DAST

Job description

Oshi Health seeks a Senior Security Engineer to own the security of its fully remote, cloud-native healthcare platform. You will shape security architecture, manage non-human identities, and harden workflows as AI-driven development expands. This is a hands-on, builder-focused role with broad scope across security controls.

You will lead threat modeling, secure design reviews, and secure code practices, while collaborating with engineering to balance risk and product delivery.