Senior Application Security Engineer, Oshi Health

• Bachelor's degree in Computer Science or equivalent practical experience
• 6+ years in security engineering, with demonstrated depth in application/product security and cloud security (AWS). Experience in healthcare, fintech, or another regulated, data-sensitive environment is a strong plus
• Hands-on experience with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security
• Strong identity and access management skills, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and the management of non-human identities and secrets
• Familiarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk
• Comfort being the sole security specialist on a small, cross-functional team, prioritizing ruthlessly by risk, and explaining tradeoffs clearly to engineers and non-technical executives
• Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework
• Proficiency with scripting and automation (Python and at least one shell)

Desirable

• As Oshi Health's first dedicated Senior Security Engineer, you will own the technical security of its fully remote, SaaS and cloud-native healthcare platform, protecting sensitive health data. This hands-on, builder-focused role will set security architecture standards, harden identity and secrets management, and build security into engineering and AI workflows as the platform adopts agentic AI development
• Own application and product security, including threat modeling, secure design review, and secure code review, focusing on access-control and secrets-exposure flaws affecting the member-facing healthcare app and its APIs
• Design and own the security architecture for Oshi's shift to an agentic software development lifecycle, including phase-gate criteria, out-of-band controls so AI-written code is never its own security gate, and tested clawback procedures for when risk spikes
• Build and run non-human identity and secrets management at scale, covering service accounts, scoped tokens, OAuth grants, and machine credentials across the SaaS and AWS estate
• Secure the AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform
• Enforce and tune security tooling, including GitHub Advanced Security (CodeQL, secret scanning, push protection), branch protection, and CODEOWNERS-enforced review on sensitive paths
• Review AI and third-party vendor integrations before they handle PHI, evaluating data flows, retention, and data loss-prevention needs
• Own vulnerability management and the penetration-testing relationship, driving findings to closure and feeding recurring issues back into the development process
• Support HIPAA Security Rule technical safeguards, establish detection and response capabilities, and build automation that enables a small security function to operate with outsized leverage