> Markdown version of [/jobs/ext/4202374-senior-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4202374-senior-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Application Security Engineer

- **Company:** Oshi Health
- **Location:** Columbus, OH, United States (Remote available)
- **Experience:** Expert
- **Salary:** $170,000.0 - $190,000.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Amazon Web Services, Amazon S3, Cloud Computing Security, Cyber Security, Data Loss, Github, Identity and Access Management, Python (Programming Language), Network Segmentation, OAuth, OpenID, Anti-Phishing, Security Assertion Markup Language (SAML), Data Streaming, Software Vulnerability Management, Data Logging, Okta, Large Language Models, Software Security, GWAPT, Infrastructure Automation Frameworks, Information Technology, Terraform, Static Application Security Testing, Dynamic Application Security Testing
- **Published:** October 20, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=20ca17ae33aa05e7

## About the Role

Required

 * Bachelor's degree in Computer Science or equivalent practical experience.
 * 6+ years in security engineering, with demonstrated depth in application/product security and cloud security (AWS). Experience in healthcare, fintech, or another regulated, data-sensitive environment is a strong plus.
 * Hands-on with secure SDLC tooling: SAST/DAST, GitHub Advanced Security/CodeQL, secret scanning, and software supply-chain/dependency security.
 * Strong in identity and access management, including Okta, OAuth/OIDC, SAML, phishing-resistant MFA, and the management of non-human identities and secrets.
 * Familiarity with, or a genuine drive to go deep on, securing AI/LLM and agentic systems: prompt injection, agent authorization and over-permissioning, NHI sprawl, and model/supply-chain risk.
 * Comfortable being the sole security specialist on a small, cross-functional team, prioritizing ruthlessly by risk and able to explain a tradeoff clearly to both engineers and non-technical executives.
 * Working knowledge of the HIPAA Security Rule, SOC 2, and the NIST Cybersecurity Framework.
 * Proficient with scripting and automation (Python and at least one shell).

Preferred

 * One or more certifications: OSCP, GIAC (e.g., GWAPT, GCSA, GCLD), AWS Certified Security - Specialty, CISSP, or Okta Certified Professional.
 * Experience operating a compliance-automation platform.

## Description

* Secure our AWS environment end to end, including IAM, network segmentation, logging, encryption, and workload protection across S3, EKS, and Terraform.
 * Enforce and tune our security tooling so it does real work, including GitHub Advanced Security (CodeQL, secret scanning, push protection), branch protection, and CODEOWNERS-enforced review on sensitive paths.
 * Review AI and third-party vendor integrations before they touch PHI, evaluating data flows, retention, and data loss-prevention needs with healthy skepticism toward vendor security claims.
 * Own vulnerability management and the penetration-testing relationship, driving findings to closure and feeding recurring issues back into the development process.
 * Support HIPAA Security Rule technical safeguards, stand up detection and response capabilities, and build the automation that lets a small security function operate with outsized leverage.