Senior AppSec Engineer — AI Health Platform

Nabla; Paris; On-site; EUR 90,000 - 120,000; Full time

Job summary

Nabla, a healthcare AI platform, is seeking a Senior Security Engineer to strengthen AppSec across product squads, cloud, and CI/CD. You’ll own security design reviews, threat modeling, and secure-by-default libraries, partnering with developers to reduce risk from the start.

The role blends hands-on coding in Kotlin and Python with security architecture, including OAuth2/OIDC, SCA, SAST, pentest coordination, and vulnerability management.

Qualifications

• 5 to 8+ years in security engineering, including at least 2 to 3 years in application or product security, or experience as a software engineer with a strong security focus.
• Deep understanding of modern web and API security: OAuth 2.0 / OIDC, session and token design, multi‑tenancy, and the OWASP Top 10 and API Top 10.
• Strong coder, comfortable reading and fixing production code (Kotlin and Python) and automating in Python.
• Experience running threat modeling and security design reviews, and operating SAST, SCA and secrets scanning in CI with a real triage loop.
• Genuine breadth: moving between API design reviews, supply-chain hardening PRs and incidents in the same week.
• Excellent communicator who earns developers’ trust and works well with engineering, compliance and IT.
• Full professional fluency in French and English (oral and written).

Responsibilities

• Partner with product squads as their go-to security engineer: design reviews, threat modeling, and fast, opinionated answers on authN/authZ, tokens and session design.
• Secure authentication and authorization surfaces (OAuth clients, one-time codes, multi-org tenancy, Core API user API, embedded/postMessage SDKs) and hunt for flaws before attackers do.
• Run the code-security findings loop: triage and prioritize results from SAST, SCA, secrets and IaC scanners and AI-driven code review, route them to owners with SLAs, and drive backlog down.
• Secure AI/LLM features and internal agents, covering prompt injection, tool and permission scoping, PHI leakage, de-identification and model egress.
• Run external testing: scope and run pentests, validate fixes, manage vulnerability disclosure, and stand up a bug bounty.
• Build secure-by-default guardrails (secure coding guidelines, hardened libraries, pre-commit and PR checks).

Skills

Security engineering

AppSec

OAuth 2.0 / OIDC

Kotlin

Python

Threat modeling

Communication

Job description

Nabla, a healthcare AI platform, is seeking a Senior Security Engineer to strengthen AppSec across product squads, cloud, and CI/CD. You’ll own security design reviews, threat modeling, and secure-by-default libraries, partnering with developers to reduce risk from the start.

The role blends hands-on coding in Kotlin and Python with security architecture, including OAuth2/OIDC, SCA, SAST, pentest coordination, and vulnerability management.