Senior Security Engineer - Remote, Cloud & HIPAA-Ready

Oshi Health; Portland (ME); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

11 holidays + 1 floating holiday

Remote-first

Job summary

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security of our fully remote, cloud-native healthcare platform. You will set security architecture standards, harden identity and secrets management, and integrate security into engineering and AI workflows from day one.

This hands-on role includes threat modeling, secure design reviews, IAM, SSO, vulnerability management, and ensuring PHI protection while working with a small cross-functional team in a remote-first

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with depth in application/product security and cloud security (AWS).
• Healthcare, fintech, or other regulated data-sensitive environments are a strong plus.
• Hands-on with SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain security.
• Strong identity and access management skills (Okta, OAuth/OIDC, SAML, MFA, non-human identities).
• Familiarity with securing AI/LLM and agentic systems: prompt injection, agent authorization, risk management.
• Able to be the sole security specialist on a small, cross-functional team and communicate tradeoffs clearly.
• Working knowledge of HIPAA Security Rule, SOC 2, and NIST CSF.
• Proficient in Python and at least one shell.
• Preferred certifications: OSCP, GIAC, AWS Certified Security – Specialty, CISSP, Okta Certified.

Responsibilities

• Own application and product security, including threat modeling, secure design review, and secure code review, focusing on access-control and secrets-exposure risks for a healthcare app and APIs.
• Design and own the security architecture for the shift to an agentic SDLC, including phase-gate criteria and risk controls.
• Build and run non-human identity and secrets management at scale across SaaS and AWS.
• Secure AWS environment end to end: IAM, network segmentation, logging, encryption, workload protection (S3, EKS, Terraform).
• Enforce and tune security tooling (GitHub Advanced Security, CodeQL, secret scanning, push protection; CODEOWNERS-enforced review).
• Review AI and third-party vendor integrations before touch PHI; evaluate data flows, retention, and DLP needs.
• Own vulnerability management and penetration-testing relationship; drive findings to closure and feed back into development.
• Support HIPAA Security Rule safeguards; stand up detection and response capabilities; build automation for a lean security function.

Skills

Application security

Cloud security (AWS)

IAM / MFA / SSO

Scripting (Python & shell)

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security

CodeQL

Secret scanning

SAST/DAST

Terraform

AWS

Job description

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security of our fully remote, cloud-native healthcare platform. You will set security architecture standards, harden identity and secrets management, and integrate security into engineering and AI workflows from day one.

This hands-on role includes threat modeling, secure design reviews, IAM, SSO, vulnerability management, and ensuring PHI protection while working with a small cross-functional team in a remote-first