Senior Security Engineer - Cloud & App Security, Remote

Oshi Health; Salem (OR); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

11 holidays + floating holiday

401(k)

Remote-first

Job summary

Oshi Health is seeking a Senior Security Engineer to own the security of our remote-first, cloud-native healthcare platform. You will lead threat modeling, secure design, and code reviews for a member-facing app and its APIs, with emphasis on access control and secrets management.

You will shape security architecture for an agentic development lifecycle, safeguard AWS environments, and drive vulnerability management while collaborating with engineers and executives across the organization.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with depth in application and cloud security (AWS).
• Healthcare/fintech or regulated data environments a strong plus.
• Hands-on with SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning.
• Strong IAM including Okta, OAuth/OIDC, SAML, MFA and non-human identities.
• Familiarity with securing AI/LLM and agentic systems.
• Able to function as the sole security expert in a small team and communicate risks clearly.
• Knowledge of HIPAA Security Rule, SOC 2, and NIST CSF.
• Proficient in scripting/automation (Python and shell).
• Certifications: OSCP, GIAC, AWS Security – Specialty, CISSP, Okta CP.
• Experience operating a compliance-automation platform.

Responsibilities

• Own application and product security, focusing on access-control and secrets exposure.
• Design security architecture for agentic SDLC with phase-gate criteria and clawback.
• Build and run non-human identity and secrets management at scale.
• Secure AWS environment end-to-end: IAM, network, logging, encryption, workload protection.
• Enforce security tooling: GitHub Advanced Security, branch protection, CODEOWNERS.
• Review AI and vendor integrations touching PHI for data flow and retention.
• Own vulnerability management and pen‑testing relationships.
• Support HIPAA Security Rule safeguards and detection/response capabilities.

Skills

IAM expertise

OKTA

OAuth/OIDC

SAML

MFA (phishing-resistant)

Non-human IDs

AI/LLM security

HIPAA/NIST familiarity

Python scripting

AWS security

Education

Bachelor's degree in Computer Science or equivalent

Tools

SAST/DAST

GitHub Advanced Security/CodeQL

Secret scanning

Software supply-chain security

Job description

Oshi Health is seeking a Senior Security Engineer to own the security of our remote-first, cloud-native healthcare platform. You will lead threat modeling, secure design, and code reviews for a member-facing app and its APIs, with emphasis on access control and secrets management.

You will shape security architecture for an agentic development lifecycle, safeguard AWS environments, and drive vulnerability management while collaborating with engineers and executives across the organization.