Senior Security Engineer — Cloud & App Security (Remote)

Oshi Health; Williamstown (NJ); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

401(k) retirement plan

Remote‑first work model

Job summary

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security of our remote, SaaS and cloud-native healthcare platform. This hands-on role focuses on security architecture, identity and secrets management, and integrating security into engineering and AI workflows from day one.

You will own application and product security, design the agentic SDLC, run non-human identity at scale, secure AWS across S3/EKS/Terraform, and manage vulnerability programs.

Qualifications

• 6+ years in security engineering with depth in application/product and cloud security (AWS).
• Experience with SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain security.
• Familiarity with securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, model risk.
• Able to be the sole security specialist on a small, cross-functional team and communicate risk clearly to engineers and executives.
• Working knowledge of HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework.
• Proficient in scripting and automation (Python and at least one shell).

Responsibilities

• Own application and product security, including threat modeling, secure design review, and secure code review.
• Design and own security architecture for the agentic software development lifecycle, including phase-gate criteria and tested controls.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure AWS environment end-to-end, including IAM, network segmentation, logging, encryption, and workload protection (S3, EKS, Terraform).
• Enforce and tune security tooling (GitHub Advanced Security, CodeQL, secret scanning, branch protection).
• Review AI and third-party vendor integrations touching PHI for data flow, retention, and DLP requirements.
• Own vulnerability management and the penetration-testing relationship; drive findings to remediation.

Skills

Security engineering

Application security

Cloud security (AWS)

Scripting & automation (Python)

HIPAA Security Rule knowledge

SOC 2 knowledge

NIST CSF knowledge

AI/LLM security (prompt injection)

Education

Bachelors in Computer Science or equivalent

Tools

GitHub Advanced Security (CodeQL)

SAST/DAST tooling

Secret scanning tooling

Software supply-chain security

Job description

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security of our remote, SaaS and cloud-native healthcare platform. This hands-on role focuses on security architecture, identity and secrets management, and integrating security into engineering and AI workflows from day one.

You will own application and product security, design the agentic SDLC, run non-human identity at scale, secure AWS across S3/EKS/Terraform, and manage vulnerability programs.