Senior Security Engineer — Remote HIPAA-Sec SaaS

Oshi Health; Portland (ME); Remote; USD 170,000 - 190,000; Full time

Benefits offered by this job

Remote-first flexibility

Healthcare benefits

Flexible PTO

11 holidays + floating holiday

401(k) contribution

Job summary

Oshi Health is seeking a Senior Security Engineer to own the security of our remote, cloud‑native healthcare platform. You will set architecture standards, harden identity and secrets, and embed security into AI workflows from the start. This hands‑on role shapes how a growing platform stays safe as it scales with agentic AI.

You’ll lead vulnerability management, stand up detection/response capabilities, and partner with engineering to reduce risk in a healthcare environment.

Qualifications

• Bachelor's degree in CS or equivalent practical experience.
• 6+ years in security engineering with depth in application security and cloud security (AWS).
• Hands‑on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply‑chain security.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, MFA, and non‑human identities.
• Familiarity with securing AI/LLM and agentic systems and related risk considerations.
• Able to explain tradeoffs to engineers and executives as the sole security expert on a small team.
• Working knowledge of HIPAA Security Rule, SOC 2, and NIST CSF.
• Proficient with scripting and automation (Python and shell).

Responsibilities

• Own application and product security, with focus on access control and secrets exposure.
• Design and own security architecture for AI/agentic software development lifecycle.
• Build and run non‑human identity and secrets management at scale across SaaS and AWS.
• Secure AWS environment end‑to‑end: IAM, network, logging, encryption, workload protection.
• Enforce security tooling: GitHub Advanced Security, CodeQL, secret scanning, branch protection, CODEOWNERS reviews.
• Review AI and third‑party vendor integrations touching PHI for data flows and retention.
• Own vulnerability management and penetration testing relations, driving fixes into development.

Skills

Security engineering

IAM & MFA

Secure SDLC tooling

Python scripting

AI/LLM security

Education

Bachelor's degree in Computer Science or equivalent

Tools

GitHub CodeQL

SAST/DAST tooling

Okta

OAuth/OIDC

SAML

Terraform

AWS IAM / AWS security tooling

Job description

Oshi Health is seeking a Senior Security Engineer to own the security of our remote, cloud‑native healthcare platform. You will set architecture standards, harden identity and secrets, and embed security into AI workflows from the start. This hands‑on role shapes how a growing platform stays safe as it scales with agentic AI.

You’ll lead vulnerability management, stand up detection/response capabilities, and partner with engineering to reduce risk in a healthcare environment.