{"id":3014907,"url":"https://alion.io/job/oshi-health-senior-application-security-engineer","title":"Senior Application Security Engineer","company":{"id":174556,"name":"Oshi Health","domain":"oshihealth.com","url":"https://alion.io/company/oshi-health","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":170000,"max":190000,"currency":"USD","period":"year","gross":null,"usd_annual":190000},"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Amazon EKS","optional":false},{"name":"Amazon S3","optional":false},{"name":"AWS","optional":false},{"name":"CodeQL","optional":false},{"name":"GitHub","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"LLM","optional":false},{"name":"Okta","optional":false},{"name":"Python","optional":false},{"name":"SOC 2","optional":false},{"name":"Telegram","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"WhatsApp","optional":false},{"name":"Kubernetes","optional":true}],"status":"live","first_seen_at":"2026-10-21T13:54:11Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-10-25T12:00:17Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"Senior Security Engineer\nReports To: Sr. Director of IT & Security\nLocations hiring from: Alabama, Arizona, Arkansas, California, Colorado, Delaware, Florida, Georgia, Idaho, Illinois, Indiana, Kansas, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nevada, New Hampshire, New Jersey, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, and Wisconsin. \nEmployment Type: Full-time\nRole Overview:\nAs Oshi Health's first dedicated Senior Security Engineer, you will own the technical security of our fully remote, SaaSand cloud-native healthcare platform, protecting the sensitive health data of real people working to take back control from chronic GI conditions. This is a hands-on, builder-focused role, not a policy desk: you will set security architecture standards, harden identity and secrets management, and build security into our engineering and AI workflows from the start. It is a uniquely forward-looking opportunity to shape how a growing healthcare platform stays safe as it adopts agentic AI development, with your fingerprints on the foundation. \nWhat You'll Do - Key Responsibilities\nOwn application and product security, including threat modeling, secure design review, and secure code review, with a focus on the access-control and secrets-exposure flaws that matter most for a member-facing healthcare app and its APIs. \nDesign and own the security architecture for Oshi's shift to an agentic software development lifecycle, including phase-gate criteria, out-of-band controls so AI-written code is never its own security gate, and tested clawback procedures for when risk spikes. \nBuild and run non-human identity and secrets management at scale, covering service accounts, scoped tokens, OAuth grants, and machine credentials across our SaaS and AWS estate. \nSecure our AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform. \nEnforce and tune our security tooling so it does real work, including GitHub Advanced Security (CodeQL, secret scanning, push protection), branch protection, and CODEOWNERS-enforced review on sensitive paths. \nReview AI and third-party vendor integrations before they touch PHI, evaluating data flows, retention, and data loss-prevention needs with healthy skepticism toward vendor security claims. \nOwn vulnerability management and the penetration-testing relationship, driving findings to closure and feeding recurring issues back into the development process. \nSupport HIPAA Security Rule technical safeguards, stand up detection and response capabilities, and build the automation that lets a small security function operate with outsized leverage. \nWhat We're Looking For - Qualifications & Requirements\n Required \nBachelor's degree in Computer Science or equivalent practical experience. \n6+ years in security engineering, with demonstrated depth in application/product security and cloud security (AWS). Experience in healthcare, fintech, or another regulated, data-sensitive environment is a strong plus. \nHands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security. \nStrong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and the management of non-human identities and secrets. \nFamiliarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk. \nComfortable being the sole security specialist on a small, cross-functional team, prioritizing ruthlessly by risk and able to explain a tradeoff clearly to both engineers and non-technical executives. \nWorking knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework. \nProficient with scripting and automation (Python and at least one shell). \nPreferred \nOne or more certifications: OSCP, GIAC (e.g., GWAPT, GCSA, GCLD), AWS Certified Security - Specialty, CISSP, or Okta Certified Professional. \nExperience operating a compliance-automation platform. \nCompensation & Benefits \nSalary Range: $170,000 - $190,000 + bonus and meaningful equity \nHealth Benefits: 90% employee premiums paid for medical, dental, and vision coverage \nTime Off: Flexible PTO plus 11 Holidays and 1 floating holiday\nRetirement: Eligibility to contribute to 401(k) \nWork Style: Remote-first flexibility, work from home anywhere within our approved states in the US\nCompensation Range\n$170,000—$190,000 USD\nNote: This job description serves as a general overview and may be subject to change based on organizational needs and requirements.\nOshi Health is an equal opportunity employer that is committed to creating a diverse work environment. To do that, we champion a workplace where each and every person is treated with dignity and respect and is valued for their unique perspective and contributions.\nOshi Health’s policy is to maintain a working environment that encourages mutual respect, promotes harmonious and congenial relationships between employees, and is free from all forms of discrimination and harassment of any employee (or applicant for employment or service provider) by anyone, including supervisors, co-workers, vendors, or clients. Harassment and discrimination in any manner or form is expressly prohibited. There is no tolerance for discrimination or unequal treatment of any kind on the basis of race, color, religion, creed, gender, sex, sexual orientation, gender identity or expression, pregnancy, sexual and reproductive health decisions, national origin, age, disability, genetic information, marital status or civil partnership/union status, familial status, military or veteran status, predisposition or carrier status, domestic violence victim status, alienage or citizenship status, unemployment status, sexual violence or stalking victim status, caregiver status, or any other characteristic protected by law.\nThis practice applies to all terms, conditions and privileges of employment including, but not limited to, recruitment, selection, promotion, demotion, transfer, layoff, rehire, termination of employment, development and training, compensation, benefits and retirement.\nFor more information, visit us atwww.oshihealth.com \nOshi Health will never contact job candidates via text message or any other messaging platform including WhatsApp, Signal, and Telegram. All official correspondence will occur through email. We will never ask you to share bank account information, cash a check from us, or purchase software or equipment as part of your interview or hiring process. If you have concerns, please reach out to , and we’ll confirm whetheryou’re engaging with one of our Oshi teammates!","description_format":"text","description_chars":6896,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Telemedicine & Virtual Care","Specialist Medical Practices"],"lifecycle":[{"event":"open","at":"2026-10-21T16:22:15Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"Filed H-1B visas in the last two years","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":null,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":3,"expected_fill_days":38,"reasons":["conf:1","win:early"],"computed_at":"2026-10-25T05:49:26Z"},"pay":{"stated_usd_annual":190000,"is_top_pay":true},"html_url":"https://alion.io/job/oshi-health-senior-application-security-engineer","json_url":"https://alion.io/job/oshi-health-senior-application-security-engineer.json","meta":{"generated_at":"2026-10-25T15:09:39Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21873,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":174556},"rest":"https://alion.io/mcp/rest/get_company?id=174556"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Foshi-health-senior-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Foshi-health-senior-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Foshi-health-senior-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/oshi-health-senior-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Foshi-health-senior-application-security-engineer"}]}