SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 170,000 - 190,000 / annual
Oshi Health is seeking a Senior Application Security Engineer to be the company's first dedicated security leader. You will own the technical security of a fully remote, SaaS and cloud-native healthcare platform that serves members managing chronic GI conditions, protecting sensitive health data at scale.
This is a hands-on, builder-focused role reporting to the Sr. Director of IT & Security. You will set security architecture standards, harden identity and secrets management, and embed security into engineering and AI workflows from inception. The role offers a uniquely forward-looking opportunity to shape how a growing healthcare platform stays secure as it adopts agentic AI development.
Key Responsibilities:
- Own application and product security, including threat modeling, secure design review, and secure code review, with focus on access-control and secrets-exposure flaws for a member-facing healthcare app and its APIs.
- Design and own the security architecture for Oshi's shift to an agentic software development lifecycle, including phase-gate criteria, out-of-band controls so AI-written code is never its own security gate, and tested clawback procedures for risk spikes.
- Build and run non-human identity and secrets management at scale, covering service accounts, scoped tokens, OAuth grants, and machine credentials across SaaS and AWS infrastructure.
- Secure the AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform.
- Enforce and tune security tooling including GitHub Advanced Security (CodeQL, secret scanning, push protection), branch protection, and CODEOWNERS-enforced review on sensitive paths.
- Review AI and third-party vendor integrations before they access PHI, evaluating data flows, retention, and data loss-prevention needs with healthy skepticism toward vendor security claims.
- Own vulnerability management and the penetration-testing relationship, driving findings to closure and feeding recurring issues back into the development process.
- Support HIPAA Security Rule technical safeguards, stand up detection and response capabilities, and build automation that lets a small security function operate with outsized leverage.
Requirements:
Required:
- Bachelor's degree in Computer Science or equivalent practical experience.
- 6+ years in security engineering, with demonstrated depth in application/product security and cloud security (AWS). Experience in healthcare, fintech, or another regulated, data-sensitive environment is a strong plus.
- Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security.
- Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and the management of non-human identities and secrets.
- Familiarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk.
- Comfortable being the sole security specialist on a small, cross-functional team, prioritizing ruthlessly by risk and able to explain tradeoffs clearly to both engineers and non-technical executives.
- Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework.
- Proficient with scripting and automation (Python and at least one shell).
Preferred:
- One or more certifications: OSCP, GIAC (e.g., GWAPT, GCSA, GCLD), AWS Certified Security – Specialty, CISSP, or Okta Certified Professional.
- Experience operating a compliance-automation platform.
