Note: The job is a remote job and is open to candidates in USA. Optimal is hiring a Senior Security Engineer to establish the security foundation for a high-growth digital health company operating in a regulated market. The role owns application, product, AWS cloud, identity, secrets, and agentic SDLC security, including building the security program from the ground up and implementing automated controls.
Responsibilities
- Own application and product security: threat modelling, secure design review, and secure code review focused on authorisation and access-control flaw classes across a member-facing app and its APIs
- Design and own the security architecture for an agentic SDLC: phase-gate criteria, out-of-band controls for agent-written code, and lifecycle management for non-human identities
- Secure the AWS environment: IAM, network segmentation, logging, config baselines, encryption, and workload protection
- Build and run non-human identity and secrets management at scale: service accounts, scoped tokens, OAuth grants, rotation, and least privilege
- Enforce and tune GitHub Advanced Security as required status checks, and automate so a small security function operates with outsized leverage
Skills
- •Must have Startup Experience •
- Eligibility: Existing US work authorization only - •No visa sponsorship, F1 visas, or visa transfers. •
- • 6+ years in security engineering, with genuine depth in AppSec and AWS cloud security
- • •Built a security programme from 0→1 inside a startup or scale-up (not a large, slow enterprise seat) •
- • Hands-on with secure SDLC tooling: SAST/DAST and GitHub Advanced Security (CodeQL, secret scanning, push protection)
- • Strong Python and shell scripting for automation
- • Experience in a regulated industry (healthtech, fintech, insurtech or similar)
- • Must have startup experience
- • Working knowledge of HIPAA, SOC 2, and NIST CSF
- • Strong IAM background: Okta, OAuth/OIDC, SAML, non-human identity management
- • Security certification (OSCP, GIAC, or CISSP)
- • Genuine interest in AI/agent security
Benefits
- Competitive equity
- Fully remote (US-based)
Company Overview