Senior Security Engineer, Application Security

Hi, we're Oscar. We're hiring a Senior Security Engineer, Application Security to join our Security team.

Oscar is the first health insurance company built around a full stack technology platform and a focus on serving our members. We started Oscar in 2012 to create the kind of health insurance company we would want for ourselves—one that behaves like a doctor in the family.

About the Role:

As a Senior Security Engineer, you will collaborate closely with fellow Security team members as well as with cross-functional partners within Engineering and Product. Your primary objective will be to safeguard classified information by thoroughly assessing and examining Oscar's applications and infrastructure. In addition, you will be responsible for presenting identified risks and providing guidance on best practices to prevent future vulnerabilities.

You will report into the Senior Director of Security. This is a remote / work-from-home role. You must reside in one of the following states: Arizona, California, Colorado, Connecticut, Florida, Georgia, Illinois, Iowa, Maryland, Massachusetts, Michigan, New Hampshire, New Jersey, New Mexico, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, Tennessee, Texas, Utah, Virginia, Washington, or Washington, D.C. Note, this list of states is subject to change. #LI-Remote

The base pay for this role is $156,560-$205,485 per year. You are also eligible for employee benefits, company equity grants, participation in Oscar's unlimited vacation program and annual performance bonuses.

Responsibilities: 

• Partner with cross-functional teams to identify, mitigate, and resolve security issues within Oscar’s tech stack (Web Applications, Mobile Apps, Network, Cloud)
• Perform and document technical testing based on industry recognized standards (OWASP) and best practices to identify security vulnerabilities against Oscar owned assets (website, mobile applications, networks and cloud environments), including:
• Threat Modeling
• Architecture/Design Reviews
• Application and Cloud Security Testing (Red Teaming)
• Lead internal workshops with cross functional teams to discuss outcomes from technical reviews and develop a plan for mitigating identified risks
• Exhibit a deep understanding of Oscar’s technology footprint, how our systems work and how they may be attacked or abused
• Collaborate with Security Leadership regarding technical vulnerabilities and potential impact if exploited
• Collaborate with non-technical teams to propose control and process enhancements to mitigate technical risk
• Stay up-to-date with current security trends, advisories, publications and relevant research for the organization
• Define hardening and secure design standards and use them to perform application security reviews in partnership with developer teams

Requirements:

• 5+ years of experience assessing Web Applications, Cloud Environments, Mobile Applications and Network security  
• Ability to simplify complex security issues into actionable steps for remediation or risk mitigation
• Knowledge of industry recognized methodologies and frameworks for security testing (OWASP, OSSTM, PTES)
• Experience testing web applications for security vulnerabilities
• Experience testing mobile applications for security vulnerabilities
• Experience assessing cloud environment for misconfigurations and security vulnerabilities
• Experience testing networks for security vulnerabilities
• Working familiarity with AWS and GCP
• Experience using containers and container orchestration technology (Mesos and Kubernetes)

Bonus Points:

• Prior work experience in a risk management capacity
• Industry recognized certifications around offensive security (OSCP, OSCE,OSWP,OSWA,OSWE)
• Prior work experience in or understanding of security challenges specific to the healthcare or health insurance industries
• Experience assessing containers for security vulnerabilities