Senior Security Engineer (Remote) — Healthcare SaaS

Oshi Health; Missouri; Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Flexible PTO

Remote-first work style

401(k)

Job summary

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security architecture of a cloud-native, healthcare SaaS platform. This hands-on role focuses on identity, secrets management, and secure engineering across AI workflows.

You will drive threat modeling, secure design reviews, and code security for a member-facing app and its APIs, while maintaining compliance with healthcare data protection standards.

Qualifications

• 6+ years in security engineering, with depth in application/product security and cloud security (AWS).
• Familiar with HIPAA/SOC 2/NIST Cybersecurity Framework and healthcare or regulated environments is a plus.
• Experience with SAST/DAST and security automation tooling.

Responsibilities

• Own application and product security including threat modeling and secure design/code reviews.
• Design and own security architecture for agentic SDLC and phase-gate criteria.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure AWS environment including IAM, networking, logging, encryption, and workload protection.

Skills

Security engineering

Application security

Cloud security (AWS)

Threat modeling

Scripting & automation (Python, shell)

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub Advanced Security/CodeQL

Secret scanning

Software supply-chain security

Job description

Oshi Health is seeking its first dedicated Senior Security Engineer to own the security architecture of a cloud-native, healthcare SaaS platform. This hands-on role focuses on identity, secrets management, and secure engineering across AI workflows.

You will drive threat modeling, secure design reviews, and code security for a member-facing app and its APIs, while maintaining compliance with healthcare data protection standards.