Senior Security Engineer - Compliance Operations

Oshi Health; Alton (IL); Remoto; USD 170.000 - 190.000; Tempo pieno

Vantaggi offerti da questo lavoro

Health benefits

Flexible PTO & holidays

401(k) retirement plan

Descrizione del lavoro

Oshi Health seeks a Director of IT & Security to own the security of a fully remote SaaS and cloud-native platform. You will design security architecture, harden identity/secrets management, and integrate security into AI workflows from the start.

You will focus on access-control, secure design reviews, vulnerability management, and reviews of AI/vendor integrations touching PHI. This role requires 6+ years in security engineering and strong AWS expertise.

Competenze

• 6+ years in security engineering with depth in application/product and cloud security (AWS).
• Experience with SAST/DAST, CodeQL, secret scanning, and software supply-chain security.
• Familiarity with securing AI/LLM and agentic systems: prompt injection and access control.
• Able to be the sole security expert on a small, cross-functional team and communicate tradeoffs.
• Working knowledge of HIPAA Security Rule, SOC 2, and NIST CSF.
• Proficient with scripting and automation (Python and at least one shell).

Mansioni

• Own application and product security across the platform and APIs.
• Design security architecture for agentic SDLC, phase-gate criteria, and controls.
• Build and run non-human identity and secrets management at scale.
• Secure AWS environment end to end: IAM, network segmentation, logging, encryption.
• Enforce and tune security tooling: CodeQL, CODEOWNERS-enforced reviews.
• Review AI and vendor integrations touching PHI for data flows and DLP needs.
• Own vulnerability management and pen-testing findings through to closure.

Conoscenze

Security engineering

Application security

Cloud security

SAST/DAST

AI/LLM security

Scripting Python

Clear communication

HIPAA/NIST awareness

Formazione

Bachelor's degree in Computer Science

Strumenti

GitHub Advanced Security

CodeQL

Okta

Terraform

AWS services (IAM, S3, EKS)

Descrizione del lavoro

Director of IT & Security

Employment Type: Full-time

As Oshi Health's first dedicated Senior Security Engineer, you will own the technical security of our fully remote, SaaSand cloud-native healthcare platform, protecting the sensitive health data of real people working to take back control from chronic GI conditions. This is a hands-on, builder-focused role, not a policy desk: you will set security architecture standards, harden identity and secrets management, and build security into our engineering and AI workflows from the start. It is a uniquely forward-looking opportunity to shape how a growing healthcare platform stays safe as it adopts agentic AI development, with your fingerprints on the foundation.

Own application and product security, including threat modeling, secure design review, and secure code review, with a focus on the access-control and secrets-exposure flaws that matter most for a member-facing healthcare app and its APIs.

Design and own the security architecture for Oshi's shift to an agentic software development lifecycle, including phase-gate criteria, out-of-band controls so AI-written code is never its own security gate, and tested clawback procedures for when risk spikes.

Build and run non-human identity and secrets management at scale, covering service accounts, scoped tokens, OAuth grants, and machine credentials across our SaaS and AWS estate.

Secure our AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform.

Enforce and tune our security tooling so it does real work, including GitHub Advanced Security (CodeQL, secret scanning, push protection), branch protection, and CODEOWNERS-enforced review on sensitive paths.

Review AI and third-party vendor integrations before they touch PHI, evaluating data flows, retention, and data loss-prevention needs with healthy skepticism toward vendor security claims.

Own vulnerability management and the penetration-testing relationship, driving findings to closure and feeding recurring issues back into the development process.

Bachelor's degree in Computer Science or equivalent practical experience.

• ~6+ years in security engineering, with demonstrated depth in application/product security and cloud security (AWS). Experience in healthcare, fintech, or another regulated, data-sensitive environment is a strong plus.
• ~ SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security.
• ~ Familiarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk.
• ~ Comfortable being the sole security specialist on a small, cross-functional team, prioritizing ruthlessly by risk and able to explain a tradeoff clearly to both engineers and non-technical executives.
• ~ Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework.
• ~ Proficient with scripting and automation (Python and at least one shell).

• GWAPT, GCSA, GCLD), AWS Certified Security – Specialty, CISSP, or Okta Certified Professional.
• Experience operating a compliance-automation platform.

Salary Range: $170,000 – $190,000 + bonus and meaningful equity

Health Benefits: 90% employee premiums paid for medical, dental, and vision coverage

Time Off: Flexible PTO plus 11 Holidays and 1 floating holiday

Retirement: Eligibility to contribute to 401(k)

Work Style: Remote-first flexibility, work from home anywhere within our approved states in the US

Oshi Health’s policy is to maintain a working environment that encourages mutual respect, promotes harmonious and congenial relationships between employees, and is free from all forms of discrimination and harassment of any employee (or applicant for employment or service provider) by anyone, including supervisors, co-workers, vendors, or clients. There is no tolerance for discrimination or unequal treatment of any kind on the basis of race, color, religion, creed, gender, sex, sexual orientation, gender identity or expression, pregnancy, sexual and reproductive health decisions, national origin, age, disability, genetic information, marital status or civil partnership/union status, familial status, military or veteran status, predisposition or carrier status, domestic violence victim status, alienage or citizenship status, unemployment status, sexual violence or stalking victim status, caregiver status, or any other characteristic protected by law. This practice applies to all terms, conditions and privileges of employment including, but not limited to, recruitment, selection, promotion, demotion, transfer, layoff, rehire, termination of employment, development and training, compensation, benefits and retirement.

Oshi Health will never contact job candidates via text message or any other messaging platform including WhatsApp, Signal, and Telegram. We will never ask you to share bank account information, cash a check from us, or purchase software or equipment as part of your interview or hiring process.