[Hiring] Senior Application Security Engineer @Oshi Health

Role Description

As Oshi Health's first dedicated Senior Security Engineer, you will own the technical security of our fully remote, SaaS and cloud-native healthcare platform, protecting the sensitive health data of real people working to take back control from chronic GI conditions. This is a hands-on, builder-focused role, not a policy desk: you will set security architecture standards, harden identity and secrets management, and build security into our engineering and AI workflows from the start. It is a uniquely forward-looking opportunity to shape how a growing healthcare platform stays safe as it adopts agentic AI development, with your fingerprints on the foundation.

Key Responsibilities

• Own application and product security, including threat modeling, secure design review, and secure code review.
• Design and own the security architecture for Oshi's shift to an agentic software development lifecycle.
• Build and run non-human identity and secrets management at scale.
• Secure our AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection.
• Enforce and tune our security tooling so it does real work.
• Review AI and third-party vendor integrations before they touch PHI.
• Own vulnerability management and the penetration-testing relationship.
• Support HIPAA Security Rule technical safeguards and build automation for a small security function.

Qualifications

• Bachelor's degree in Computer Science or equivalent practical experience.
• 6+ years in security engineering, with demonstrated depth in application/product security and cloud security (AWS).
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning.
• Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA.
• Familiarity with securing AI/LLM and agentic systems.
• Comfortable being the sole security specialist on a small, cross-functional team.
• Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework.
• Proficient with scripting and automation (Python and at least one shell).

Requirements

• One or more certifications: OSCP, GIAC (e.g., GWAPT, GCSA, GCLD), AWS Certified Security – Specialty, CISSP, or Okta Certified Professional.
• Experience operating a compliance-automation platform.

Benefits

• Salary Range: $170,000 – $190,000 + bonus and meaningful equity.
• Health Benefits: 90% employee premiums paid for medical, dental, and vision coverage.
• Time Off: Flexible PTO plus 11 Holidays and 1 floating holiday.
• Retirement: Eligibility to contribute to 401(k).
• Work Style: Remote-first flexibility, work from home anywhere within our approved states in the US.