Senior Application Security Engineer

present of AI; Paris; Hybride; EUR 90 000 - 130 000; Plein temps

Résumé du poste

Nabla is seeking a Senior Security Engineer for its Paris-based and remote-friendly engineering team. The role combines hands-on application security with cloud, build pipelines, and detection work, requiring fluency in French and English.

The ideal candidate reads Kotlin or Python code to spot access control bugs, designs robust OAuth and session mechanisms, and builds threat modeling and triage processes from scratch while earning the trust of developers.

Qualifications

• Hands-on security background with several years in security, including application security, cloud, build pipelines and detection.
• Fluent in French and English.

Responsabilités

• Identify access control bugs by reading Kotlin or Python code.
• Build threat modeling and triage processes from scratch.
• Secure build pipelines, cloud environments and detection capabilities.
• Collaborate with developers to earn trust and shape secure design choices.

Connaissances

Access control bugs

OAuth design

Session design

Threat modeling

Kotlin fluency

Python fluency

LLM security

Description du poste

Engineering · Paris office · Remote · FullTime · Senior level

This is a hands-on security engineering job where about half the time goes to application security and the rest spreads across cloud, build pipelines and detection. A strong candidate has several years in security, can spot access control bugs by reading Kotlin or Python code, and knows token, session and multi-tenant design well. They also need to build processes from scratch, such as threat modeling and a findings triage routine, while earning the trust of developers. French and English fluency are both required.

How it fits the AI era

AI already helps here through code scanning and AI-driven code review, but the work shifts toward judging what those tools surface and deciding what truly matters. The role also covers new risks from AI agents, such as prompt injection, limits on what agents may do, and keeping patient data from leaking. Human judgment stays central in design reviews, risk trade-offs and building working relationships with engineering teams.

How it builds AI experience

Nabla builds AI that writes clinical notes and runs multi-step tasks, so this role offers direct practice securing LLM features and autonomous agents that handle sensitive health data. Someone coming in with less AI security background can prepare by studying prompt injection and agent permission scoping, and by threat modeling a small agent project. Experience with de-identification checks and controlling what data leaves to model APIs would be especially relevant.

Worth showing

• Access control bug hunting


• OAuth and session design


• Threat modeling in practice


• Kotlin or Python fluency


• LLM and agent security

This is our own read, written from the employer's posting and the company's Spotlight. The employer's posting is the source of truth for the role.

About Nabla

Nabla provides an AI assistant for healthcare that captures patient-clinician conversations and generates structured clinical notes automatically, per the company.