Senior AppSec Engineer for Healthcare AI Platform

Nabla; Paris; On-site; EUR 90,000 - 110,000; Full time

Job summary

Nabla, a healthcare AI platform, is seeking a Senior Security Engineer to strengthen AppSec across product squads. You will design threat models, secure OAuth flows, and build secure-by-default guardrails while collaborating with developers, compliance, and IT.

In this role you’ll own security across CI/CD, code review, and external testing programs, with a hands-on focus on protecting PHI and patient data. Fluency in French and English is required.

Qualifications

• 5 to 8+ years in security engineering, including at least 2 to 3 years in application or product security, or experience as a software engineer with a strong security focus.
• Deep understanding of modern web and API security: OAuth 2.0 / OIDC, session and token design, multi-tenancy, and the OWASP Top 10 and API Top 10.
• Strong coder, comfortable reading and fixing production code (Kotlin and Python) and automating in Python.
• Experience running threat modeling and security design reviews, and operating SAST, SCA and secrets scanning in CI with a real triage loop, not just a dashboard.
• Genuine breadth: comfortable moving between an API design review, a supply-chain hardening PR and an incident in the same week, and honest about what you don’t know yet.
• Excellent communicator who earns developers’ trust and works well with engineering, compliance and IT.
• Full professional fluency in French and English (oral and written).

Responsibilities

• Partner with the product squads as their go-to security engineer: design reviews, per-feature threat modeling, and fast, opinionated answers on authN/authZ, tokens and session design.
• Secure our authentication and authorization surfaces (OAuth clients, one-time codes, multi-org tenancy, the Core API user API, embedded/postMessage SDKs) and hunt for BOLA, IDOR and broken access control before attackers do.
• Run the code-security findings loop: triage and prioritize results from our SAST, SCA, secrets and IaC scanners and AI-driven code review, route them to the right owners with SLAs, and drive the dependency-vulnerability backlog down, fixing issues yourself when that’s faster.
• Secure our AI/LLM features and internal agents, covering prompt injection, tool and permission scoping for autonomous agents, PHI leakage, de-identification assurance and model/API egress.
• Run the external testing program: scope and run pentests (web, mobile, backoffice), validate fixes, operate our vulnerability disclosure program, and stand up a bug bounty.
• Build secure-by-default guardrails (secure coding guidelines, hardened libraries and patterns, pre-commit and PR checks) so the secure path is the easy path.

Skills

Security engineering

Application security

OAuth 2.0 / OIDC

Threat modeling

CI/CD security

Python

Kotlin

Communication

French & English

Tools

Kotlin

Python

Job description

Nabla, a healthcare AI platform, is seeking a Senior Security Engineer to strengthen AppSec across product squads. You will design threat models, secure OAuth flows, and build secure-by-default guardrails while collaborating with developers, compliance, and IT.

In this role you’ll own security across CI/CD, code review, and external testing programs, with a hands-on focus on protecting PHI and patient data. Fluency in French and English is required.