Senior Security Engineer — Remote Healthcare SaaS Security

Oshi Health; Massachusetts; À distance; USD 170 000 - 190 000; Plein temps

Avantages offerts par ce poste

Health benefits

Flexible remote work

11 holidays and floating holiday

Résumé du poste

Oshi Health is seeking a Senior Security Engineer to own the security of our fully remote, cloud-native healthcare platform. You will build security into our engineering and AI workflows, set architecture standards, and harden identity and secrets management.

As the sole security specialist on a small team, you will drive threat modeling, secure design reviews, and risk reduction across AWS, GitHub Advanced Security, and vendor integrations while ensuring HIPAA, SOC 2, and NIST alignment.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering with demonstrated depth in application/product security and cloud security (AWS). Experience in healthcare, fintech, or another regulated, data-sensitive environment is a strong plus.
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and the management of non-human identities and secrets.
• Familiarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk.
• Comfortable being the sole security specialist on a small, cross-functional team, prioritizing ruthlessly by risk and able to explain a tradeoff clearly to both engineers and non-technical executives.
• Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework.
• Proficient with scripting and automation (Python and at least one shell).

Responsabilités

• Own application and product security, including threat modeling, secure design review, and secure code review, with a focus on access-control and secrets-exposure flaws for a healthcare app and its APIs.
• Design and own the security architecture for the shift to an agentic software development lifecycle, including phase-gate criteria and tested control procedures.
• Build and run non-human identity and secrets management at scale across SaaS and AWS estate.
• Secure our AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection.
• Enforce and tune security tooling so it does real work (CodeQL/Code scanning, push protection, CODEOWNERS enforcement).
• Review AI and third-party vendor integrations before touching PHI, evaluating data flows and DLP needs.
• Own vulnerability management and the penetration-testing relationship, driving findings to closure.
• Support HIPAA Security Rule technical safeguards, stand up detection/response capabilities, and build automation for a lean security function.

Connaissances

Application security

Cloud security (AWS)

OAuth/OIDC

Okta IAM

Python scripting

Shell scripting

HIPAA/SOC2 knowledge

AI/LLM security

Formation

Bachelor's degree in Computer Science or equivalent

Outils

GitHub Advanced Security

CodeQL

Secret scanning

SAST/DAST tooling

Description du poste

Oshi Health is seeking a Senior Security Engineer to own the security of our fully remote, cloud-native healthcare platform. You will build security into our engineering and AI workflows, set architecture standards, and harden identity and secrets management.

As the sole security specialist on a small team, you will drive threat modeling, secure design reviews, and risk reduction across AWS, GitHub Advanced Security, and vendor integrations while ensuring HIPAA, SOC 2, and NIST alignment.