Senior Application Security Engineer
Oshihealth · Remote
About this role
**Senior Application Security Engineer** **Reports To:** Sr. Director of IT & Security **Locations hiring from (Remote):** Alabama, Arizona, Arkansas, California, Colorado, Delaware, Florida, Georgia, Idaho, Illinois, Indiana, Kansas, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nevada, New Hampshire, New Jersey, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, and Wisconsin. **Employment Type:** Full-time --- ## Role Overview As Oshi Health’s first dedicated **Senior Security Engineer**, you’ll own the technical security of our **fully remote, SaaS, cloud-native healthcare platform**, protecting sensitive health data. This is a **hands-on, builder-focused** role—set security architecture standards, harden identity and secrets management, and build security into engineering and AI workflows from the start. --- ## What You’ll Do (Key Responsibilities) - Own application and product security: **threat modeling**, **secure design reviews**, and **secure code reviews**—with a focus on access-control and secrets-exposure issues. - Design and own security architecture for an **agentic software development lifecycle**, including phase-gate criteria, out-of-band controls to prevent AI-written code from being its own security gate, and tested clawback procedures when risk spikes. - Build and run **non-human identity and secrets management** at scale (service accounts, scoped tokens, OAuth grants, machine credentials) across SaaS and AWS. - Secure the **AWS environment end to end**: IAM, network segmentation, logging, encryption, and workload protection across **S3, EKS, and Terraform**. - Enforce and tune security tooling so it does real work, including **GitHub Advanced Security** (CodeQL, secret scanning, push protection), **branch protection**, and **CODEOWNERS**-enforced review on sensitive paths. - Review AI and third-party vendor integrations before they touch **PHI**, evaluating data flows, retention, and data loss-prevention needs with healthy skepticism toward vendor claims. - Own **vulnerability management** and the penetration-testing relationship—drive findings to closure and feed recurring issues back into development. - Support **HIPAA Security Rule** technical safeguards, stand up detection and response capabilities, and build automation that enables a small security function to operate with outsized leverage. --- ## What We’re Looking For (Qualifications & Requirements) **Required** - Bachelor’s degree in Computer Science (or equivalent practical experience). - **6+ years** in security engineering with demonstrated depth in **application/product security** and **cloud security (AWS)**. Healthcare, fintech, or other regulated, data-sensitive environments are a plus. - Hands-on with secure SDLC tooling: **SAST/DAST**, **GitHub Advanced Security/CodeQL**, secret scanning, and software supply-chain/dependency security. - Strong in **identity and access management**: **Okta**, **OAuth/OIDC**, **SAML**, phishing-resistant MFA, and management of non-human identities and secrets. - Drive to go deep on securing **AI/LLM and agentic systems** (e.g., prompt injection, agent authorization/over-permissioning, NHI sprawl, model/supply-chain risk). - Comfortable being the **sole security specialist** on a small, cross-functional team—prioritize ruthlessly by risk and clearly explain tradeoffs to engineers and non-technical executiv
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.