Senior Security Engineer — Cloud, AI, HIPAA (Remote)

Oshi Health; Vermont; Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Remote-first work

401(k)

Flexible PTO

Job summary

Oshi Health seeks a Senior Security Engineer to own security for its remote, cloud-native healthcare platform. You will harden identity/secrets management, set security architecture standards, and embed security into engineering and AI workflows from day one.

You will drive threat modeling, AWS security, and secure SDLC tooling, collaborating across engineering and leadership to balance risk with product velocity.

Qualifications

• Bachelor's degree or equivalent practical experience.
• 6+ years in security engineering with AWS experience.
• Hands-on with SAST/DAST, GitHub Advanced Security, secret scanning.
• Strong IAM including Okta, OAuth/OIDC, SAML, MFA.
• Security for AI/LLM and agentic systems understanding.
• Sole security expert in a small team with clear risk tradeoffs.
• Familiarity with HIPAA, SOC 2, NIST CSF.
• Proficient in Python and shell scripting.

Responsibilities

• Own application and product security including threat modeling and secure code review.
• Design security architecture for agentic SDLC and controls.
• Manage non-human identities and secrets at scale.
• Secure AWS environment including IAM, logging, encryption, and workload protection.
• Tune security tooling (GitHub Security, branch protection, CODEOWNERS).
• Review AI and vendor integrations touching PHI.
• Own vulnerability management and penetration testing relationships.
• Support HIPAA safeguards and automation for detection/response.

Skills

Application security

Cloud security (AWS)

Identity & access management

SAST/DAST tooling

Secure SDLC tooling

Python scripting

AI/LLM security

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

CodeQL

Secret scanning

AWS IAM tooling

Job description

Oshi Health seeks a Senior Security Engineer to own security for its remote, cloud-native healthcare platform. You will harden identity/secrets management, set security architecture standards, and embed security into engineering and AI workflows from day one.

You will drive threat modeling, AWS security, and secure SDLC tooling, collaborating across engineering and leadership to balance risk with product velocity.