Senior Security Engineer
Senior Security Engineer
Are you a security engineer who wants to build a program from the foundation up — not inherit and babysit someone else’s?
Do you thrive in a fast-paced, AI-native environment where security’s job is to enable speed safely, not slow it down out of fear?
Are you energized by the idea that the systems you protect hold the most sensitive health data of real people trying to get their lives back from chronic GI conditions?
If so, you might be a perfect fit for our team of professionals dedicated to eliminating the impact of digestive health conditions through innovative GI care.
The Role
As Oshi Health ’s first dedicated Senior Security Engineer, you will own the technical security of a fully remote, SaaS- and cloud-native healthcare platform — and you’ll do it as a hands-on builder, not a policy desk. Reporting to the Sr. Director, Security & IT, you will set the security architecture standards for our product and AWS environments, harden how we manage identity and secrets, and build security into our engineering and AI workflows from the start.
This is a uniquely forward-looking role. Oshi is transitioning to an agentic software development lifecycle in which AI agents help plan, build, review, and eventually deploy code against a data platform that touches regulated data. You will design the guardrails that make that transition safe: the security gates in the pipeline, the controls on agent-written code, and the lifecycle management for the non-human identities those agents use. You’ll partner closely with Product & Engineering to keep the path paved — moving fast with confidence rather than slow out of fear — and with the Sr. Director on HIPAA, SOC 2, and audit readiness. If you want a security role where the work is genuinely novel and your fingerprints are on the foundation, this is it.
What you’ll do
-
Own application and product security: threat modeling, secure design review, and secure code review, with a focus on the authorization and access-control flaw classes (IDOR, broken access control, exposed secrets, insecure upload) that matter most for a member-facing healthcare app and its APIs.
-
Make our existing tooling do real work: enforce and tune GitHub Advanced Security (CodeQL, secret scanning, push protection) as required status checks, with branch protection and CODEOWNERS-enforced human review on security-sensitive paths.
-
Design and own the security architecture for our agentic SDLC — phase-gate criteria for each stage of the AI transition, deterministic out-of-band controls so that agent-written code is never its own security gate of record, and tested “clawback” procedures for when risk spikes.
-
Build and run non-human identity (NHI) and secrets management at scale: service accounts, scoped tokens, OAuth grants, and machine credentials — provisioning, rotation, least privilege, and decommissioning across our SaaS and AWS estate.
-
Secure our AWS environment: IAM/IC, network segmentation, logging, configuration baselines, encryption, and workload protection across S3, EKS and Terraform (and supporting services in coordination with our DevOps team)
-
Run security review of AI and third-party vendor integrations before they touch PHI — evaluating data flows, retention, and data-loss-prevention needs, and applying healthy skepticism to AI-native vendors’ security claims.
-
Stand up and tune detection and response Leverage AI and build behavioral baselines and anomaly detection for identity, SaaS, AWS, and AI/agent usage logs.
-
Support HIPAA Security Rule technical safeguards in partnership with the Sr. Director — encryption at rest, audit controls and activity logging, vulnerability scanning, and asset inventory.
-
Own the vulnerability management and penetration-testing cadence: Own the relationship with an external pen tester, drive findings to closure, shrink time-to-remediation, and move recurring issues left into the development process.
-