Senior Security Engineer (Product Security)

Oscar Health; Los Angeles (CA); On-site; USD 140,000 - 180,000; Full time

Job summary

Oscar Health is seeking a Senior Product Security Engineer 1 to lead the security of the software development life cycle from design to delivery. You will operate at the intersection of traditional application security and AI-driven engineering, ensuring fast, secure development across paved roads.

You will mentor junior engineers, drive vulnerability management from SAST/DAST to remediation, review code, partner with engineering for remediation, and ensure compliance with healthcare industry

Qualifications

• 4+ years of combined software development and information security experience.
• Hands-on experience across the Secure Software Development Life Cycle.
• Proven ability to work with AI models and integrate them with internal systems.
• Strong background in building moderately complex standalone systems or major features.
• Bachelor's degree or four years of equivalent experience, healthcare/health insurance domain a plus.

Responsibilities

• Lead security of the SDLC from design to deployment.
• Architect, build, test, and deploy security systems and processes.
• Design security for AI-driven workflows and integrate reviews into AI agent processes.
• Drive vulnerability management lifecycle from automated detection to remediation tracking.
• Mentor junior engineers and foster smooth, productive workflows.
• Conduct source code reviews of internal and third-party software.
• Build risk assessment frameworks and deliver actionable mitigation plans.
• Collaborate with Engineering to remediate or migrate vulnerabilities.
• Ensure compliance with applicable laws and regulations.

Skills

SDLC security

AI integration

Vulnerability management

Code review

Mentorship

Security architecture

Education

Bachelor's degree

Tools

SAST

DAST

MCP Protocol

Job description

• We’re hiring a Senior Product Security Engineer 1 to join our Security Team
• As a Senior Product Security Engineer, you will be a key technical resource for the team, leading the security of the software development life cycle (SDLC) from design to completion. You will work at the intersection of traditional application security and modern AI-driven engineering, ensuring that our “paved roads” for development remain fast and secure
• You will work to Secure Architecture. You will help architect, build, test, and deploy Oscar’s application security systems and processes
• You will work on AI Integration & Security. You will design security measures for AI-driven workflows, specifically integrating security reviews into AI agent processes that bypass traditional ticketing
• You will report into the Manager of Product Security
• Vulnerability Management: Drive the vulnerability management lifecycle, from automated identification (SAST/DAST) to complex manual analysis and remediation tracking
• Technical Mentorship: Act as a technical resource and mentor to junior engineers, providing guidance to remove obstacles and develop smooth, highly functional workflows
• Code Review & Development: Conduct source code reviews of internal and third-party software while writing production-quality code and libraries for engineering teams to utilize
• Risk Assessment: Build risk assessment frameworks and deliver action plans to manage assessed risks, simplifying intricate security concerns into actionable steps
• Partner with Engineering: Provide guidance to Engineering teams for remediating or migrating vulnerabilities. Give in-depth software security presentations to the engineering team
• Compliance with all laws and regulations
• Other Duties as Assigned

4+ years of combined career experience in software development and information securityProven experience across all areas of the Secure Software Development Life CycleHands-on experience using AI models and integrating them with internal systems via protocols like the Model Context Protocol (MCP)Strong background in building moderate to complex standalone systems or major new featuresBachelors degree or four years of equivalent experiencePrior work experience in or understanding of security challenges specific to the healthcare or health insurance industries