Senior Security Engineer, Oshi Health

• 6+ years in security engineering, with demonstrated depth in application/product security and cloud security (AWS). Experience in healthcare, fintech, or another regulated, data-sensitive environment is a strong plus
• Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security / CodeQL, secret scanning, and software supply-chain / dependency security
• Strong in identity and access management: Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and the management of non-human identities and secrets (e.g., AWS Secrets Manager, or equivalents)
• Familiarity with — or genuine drive to go deep on — securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk. You don’t need to have done it for a decade; almost no one has. You do need to be the kind of engineer who runs toward a problem the industry hasn’t solved yet
• Comfortable being the sole security specialist on a small, cross-functional team — you prioritize ruthlessly by risk, you’re pragmatic about cost, and you can explain a tradeoff to both an engineer and a non-technical executive without changing the truth of it
• Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework. Experience operating a compliance-automation platform is a plus
• Proficient with scripting and automation (Python and at least one shell) to scale yourself
• A curious, builder’s mindset — you’d rather pave a safe path than post a “do not enter” sign, and you find the right technology to increase both security and velocity
• Bachelor’s degree in Computer Science or equivalent practical experience

Desirable

• Own application and product security: threat modeling, secure design review, and secure code review, with a focus on the authorization and access-control flaw classes (IDOR, broken access control, exposed secrets, insecure upload) that matter most for a member-facing healthcare app and its APIs
• Make our existing tooling do real work: enforce and tune GitHub Advanced Security (CodeQL, secret scanning, push protection) as required status checks, with branch protection and CODEOWNERS-enforced human review on security-sensitive paths
• Design and own the security architecture for our agentic SDLC — phase-gate criteria for each stage of the AI transition, deterministic out-of-band controls so that agent-written code is never its own security gate of record, and tested “clawback” procedures for when risk spikes
• Build and run non-human identity (NHI) and secrets management at scale: service accounts, scoped tokens, OAuth grants, and machine credentials — provisioning, rotation, least privilege, and decommissioning across our SaaS and AWS estate
• Secure our AWS environment: IAM/IC, network segmentation, logging, configuration baselines, encryption, and workload protection across S3, EKS and Terraform (and supporting services in coordination with our DevOps team)
• Run security review of AI and third-party vendor integrations before they touch PHI — evaluating data flows, retention, and data-loss-prevention needs, and applying healthy skepticism to AI-native vendors’ security claims
• Stand up and tune detection and response Leverage AI and build behavioral baselines and anomaly detection for identity, SaaS, AWS, and AI/agent usage logs
• Support HIPAA Security Rule technical safeguards in partnership with the Sr. Director — encryption at rest, audit controls and activity logging, vulnerability scanning, and asset inventory
• Own the vulnerability management and penetration-testing cadence: Own the relationship with an external pen tester, drive findings to closure, shrink time-to-remediation, and move recurring issues left into the development process
• Reduce attack surface through SaaS and identity rationalization, and write the security policies, standards, and runbooks the program needs as it matures
• Build automation (scripting, infrastructure-as-code) so that a small security function operates with outsized leverage