Senior Application Security Engineer

oshihealth · Remote

Senior Security Engineer Reports To: Sr. Director of IT & Security Locations hiring from: Alabama, Arizona, Arkansas, California, Colorado, Delaware, Florida, Georgia, Idaho, Illinois, Indiana, Kansas, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nevada, New Hampshire, New Jersey, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, and Wisconsin.  Employment Type: Full-time   Role Overview:   As Oshi Health's first dedicated Senior Security Engineer, you will own the technical security of our fully remote, SaaSand cloud-native healthcare platform, protecting the sensitive health data of real people working to take back control from chronic GI conditions. This is a hands-on, builder-focused role, not a policy desk: you will set security architecture standards, harden identity and secrets management, and build security into our engineering and AI workflows from the start. It is a uniquely forward-looking opportunity to shape how a growing healthcare platform stays safe as it adopts agentic AI development, with your fingerprints on the foundation.    What You'll Do — Key Responsibilities   <ul> <li>Own application and product security, including threat modeling, secure design review, and secure code review, with a focus on the access-control and secrets-exposure flaws that matter most for a member-facing healthcare app and its APIs. </li> <li>Design and own the security architecture for Oshi's shift to an agentic software development lifecycle, including phase-gate criteria, out-of-band controls so AI-written code is never its own security gate, and tested clawback procedures for when risk spikes. </li> <li>Build and run non-human identity and secrets management at scale, covering service accounts, scoped tokens, OAuth grants, and machine credentials across our SaaS and AWS estate. </li> <li>Secure our AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform. </li> <li>Enforce and tune our security tooling so it does real work, including GitHub Advanced Security (CodeQL, secret scanning, push protection), branch protection, and CODEOWNERS-enforced review on sensitive paths. </li> <li>Review AI and third-party vendor integrations before they touch PHI, evaluating data flows, retention, and data loss-prevention needs with healthy skepticism toward vendor security claims. </li> <li>Own vulnerability management and the penetration-testing relationship, driving findings to closure and feeding recurring issues back into the development process. </li> <li>Support HIPAA Security Rule technical safeguards, stand up detection and response capabilities, and build the automation that lets a small security function operate with outsized leverage. </li> </ul>   What We're Looking For — Qualifications & Requirements  Required  <ul> <li>Bachelor's degree in Computer Science or equivalent practical experience. </li> <li>6+ years in security engineering, with demonstrated depth in application/product security and cloud security (AWS). Experience in healthcare, fintech, or another regulated, data-sensitive environment is a strong plus. </li> <li>Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security. </li> <li>Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and the management of non-human identities and secrets. </li> <li>Familiarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk. </li> <li>Comfortable being the sole security specialist on a small, cross-functional team, prioritizing ruthlessly by risk and able to explain a tradeoff clearly to both engineers and non-technical executives. </li> <li>Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework. </li> <li>Proficient with scripting and automation (Python and at least one shell). </li> </ul>   Preferred  <ul> <li>One or more certifications: OSCP, GIAC (e.g., GWAPT, GCSA, GCLD), AWS Certified Security – Specialty, CISSP, or Okta Certified Professional. </li> <li>Experience operating a compliance-automation platform. </li> </ul>   Compensation & Benefits    <ul> <li>Salary Range: $170,000 – $190,000 + bonus and meaningful equity </li> <li>Health Benefits: 90% employee premium

Let Nod apply for you →