Senior Security Engineer | AppSec | AWS Cloud Security | 0→1 Security Build | Agentic SDLC

Senior Security Engineer | AppSec | AWS Cloud Security | 0→1 Security Build | Agentic SDLC

ℹ️ Startup 0-1 experience is a must, along with experience in healthcare or healthtech industry

Package: $170,000 - $200,000 + competitive equity

Location: Fully remote (US-based)

Eligibility: Existing US work authorization only - No visa sponsorship, F1 visas, or visa transfers.

🚨 Please only apply if you have ALL of the following 🚨

• 6+ years in security engineering, with genuine depth in AppSec and AWS cloud security
• Built a security programme from 0→1 inside a startup or scale-up (not a large, slow enterprise seat)
• Hands-on with secure SDLC tooling: SAST/DAST and GitHub Advanced Security (CodeQL, secret scanning, push protection)
• Strong Python and shell scripting for automation
• Relevent Security certification (OSCP, GIAC, or CISSP)
• Experience in a regulated industry (healthtech, fintech, insurtech or similar)
• Must have startup experience

Role Overview

We’re partnered on a confidential search with a high-growth, investor-backed digital health company that’s already proven itself at real scale in a regulated market. This is their first dedicated security hire - a genuine 0→1 build, not a policy desk.

You’ll own the technical security of a fully remote, cloud-native platform handling sensitive regulated data. Think hands-on builder: setting the security architecture standard across product and AWS, hardening identity and secrets management, and designing the guardrails for their move to an agentic SDLC, where AI agents help plan, build, and ship code. This is genuinely novel work most security engineers won’t touch for years, and your fingerprints will be on the foundation.

Key Responsibilities

• Own application and product security: threat modelling, secure design review, and secure code review focused on authorisation and access-control flaw classes across a member-facing app and its APIs
• Design and own the security architecture for an agentic SDLC: phase-gate criteria, out-of-band controls for agent-written code, and lifecycle management for non-human identities
• Secure the AWS environment: IAM, network segmentation, logging, config baselines, encryption, and workload protection
• Build and run non-human identity and secrets management at scale: service accounts, scoped tokens, OAuth grants, rotation, and least privilege
• Enforce and tune GitHub Advanced Security as required status checks, and automate so a small security function operates with outsized leverage

Nice to Have

• Working knowledge of HIPAA, SOC 2, and NIST CSF
• Strong IAM background: Okta, OAuth/OIDC, SAML, non-human identity management
• Security certification (OSCP, GIAC, or CISSP)
• Genuine interest in AI/agent security

This is a rare chance to build the security foundation of a fast-scaling health-tech platform from scratch, and shape how AI ships code safely against regulated data. If that’s you, apply now for a fast response.