Senior Security Engineer: Cloud, AI & HIPAA (Remote)

Oshi Health; Yorktown (VA); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

11 holidays + 1 floating holiday

401(k) contribution eligibility

Remote-first within US states

Job summary

Oshi Health seeks a Senior Security Engineer to own the security of its fully remote, cloud-native healthcare platform. You will set architecture standards, secure identity/secrets, and embed security into engineering and AI workflows from the ground up.

You will lead threat modeling, secure design reviews, and vulnerability management while collaborating with a small cross-functional team and reporting to the Sr. Director of IT & Security. Remote-first within approved US states.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering, with depth in application/product security and cloud security (AWS).
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain security.
• Strong in identity and access management including Okta, OAuth/OIDC, SAML, MFA, and non-human identities.
• Familiarity with securing AI/LLM and agentic systems and risk management.
• Comfortable being the sole security specialist on a small team and communicating tradeoffs clearly.
• Working knowledge of HIPAA Security Rule, SOC 2, and NIST CSF.
• Proficient in scripting and automation (Python and at least one shell).

Responsibilities

• Own application and product security, focusing on access-control and secrets-exposure flaws for a member-facing healthcare app and APIs.
• Design and own the security architecture for the shift to an agentic software development lifecycle.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure our AWS environment end to end including IAM, network segmentation, logging, and encryption.
• Enforce and tune security tooling (GitHub Advanced Security, CODEOWNERS enforced reviews).
• Review AI and vendor integrations touching PHI, evaluating data flows and retention.
• Own vulnerability management and pen-testing relationships, driving closures.
• Support HIPAA Security Rule safeguards and build detection/response automation.

Skills

Security engineering

Application security

Cloud security (AWS)

Identity and access management

Scripting (Python)

Education

Bachelor's degree in Computer Science or equivalent

Tools

SAST/DAST

CodeQL

Secret scanning

Security tooling

Job description

Oshi Health seeks a Senior Security Engineer to own the security of its fully remote, cloud-native healthcare platform. You will set architecture standards, secure identity/secrets, and embed security into engineering and AI workflows from the ground up.

You will lead threat modeling, secure design reviews, and vulnerability management while collaborating with a small cross-functional team and reporting to the Sr. Director of IT & Security. Remote-first within approved US states.