Senior Security Engineer

As Oshi Health's first dedicated Senior Security Engineer, you will own the technical security of our fully remote, SaaS and cloud-native healthcare platform, protecting the sensitive health data of real people working to take back control from chronic GI conditions. This is a hands-on, builder-focused role, not a policy desk: you will set security architecture standards, harden identity and secrets management, and build security into our engineering and AI workflows from the start.

Responsibilities

Own application and product security, including threat modeling, secure design review, and secure code review; Design and own the security architecture for Oshi's shift to an agentic software development lifecycle, including phase-gate criteria, out-of-band controls, and tested clawback procedures; Build and run non-human identity and secrets management at scale, covering service accounts, scoped tokens, OAuth grants, and machine credentials across SaaS and AWS; Secure the AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform; Enforce and tune security tooling, including GitHub Advanced Security (CodeQL, secret scanning, push protection), branch protection, and CODEOWNERS-enforced review on sensitive paths; Review AI and third-party vendor integrations before they touch PHI, evaluating data flows, retention, and data loss-prevention needs; Own vulnerability management and the penetration-testing relationship, driving findings to closure; Support HIPAA Security Rule technical safeguards, stand up detection and response capabilities, and build automation for the security function

Requirements

Bachelor's degree in Computer Science or equivalent practical experience; 6+ years in security engineering with depth in application/product security and cloud security (AWS); Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security; Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and management of non-human identities and secrets; Familiarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems (prompt injection, agent authorization and over-permissioning, NHI sprawl, model/supply-chain risk); Comfortable being the sole security specialist on a small, cross-functional team, prioritizing by risk and explaining tradeoffs to engineers and non-technical executives; Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework; Proficient with scripting and automation (Python and at least one shell)

Nice to have

Experience in healthcare, fintech, or another regulated, data-sensitive environment; One or more certifications: OSCP, GIAC (e.g., GWAPT, GCSA, GCLD), AWS Certified Security – Specialty, CISSP, or Okta Certified Professional; Experience operating a compliance-automation platform

Benefits

90% employee premiums paid for medical, dental, and vision coverage; Flexible PTO plus 11 Holidays and 1 floating holiday; Eligibility to contribute to 401(k); Bonus and meaningful equity; Remote-first flexibility, work from home anywhere within approved US states