Senior AppSec Engineer: Secure AI Healthcare Platform

Nabla; Paris; On-site; EUR 90,000 - 150,000; Full time

Job summary

Nabla in Paris is seeking a Senior Security Engineer to bring AppSec expertise to product squads and strengthen security across cloud, CI/CD, and AI features. You’ll own threat modeling, code reviews, vulnerability triage, and secure-by-default libraries, partnering with developers to build robust protections for PHI and patient data.

The role blends hands-on engineering with security design and cross-team collaboration.

Qualifications

• 5 to 8+ years in security engineering, including at least 2 to 3 years in application or product security
• Deep understanding of modern web and API security: OAuth 2.0 / OIDC, session and token design, multi-tenancy, OWASP Top 10 and API Top 10
• Strong coder, able to read and fix production code (Kotlin/Python) and automate in Python
• Experience running threat modeling and security design reviews in CI with a real triage loop
• Excellent communicator who earns developers' trust and works with engineering, compliance and IT
• Fluent in French and English (oral and written)

Responsibilities

• Partner with product squads as their go-to security engineer: design reviews and per-feature threat modeling
• Secure authentication/authorization surfaces (OAuth clients, tokens, multi-org tenancy) and identify access control flaws
• Triage and prioritize findings from SAST/SCA/secrets/IaC scanners; drive backlog down
• Secure AI/LLM features: prompt injection, permission scoping, PHI leakage controls
• Run external testing program: scope pentests, validate fixes, manage vulnerability disclosure
• Build secure-by-default guardrails and secure coding guidelines

Skills

OAuth/OIDC

API security

Kotlin

Python

Threat modeling

CI/CD security

Bilingual FR/EN

Tools

SAST

SCA

Secrets scanning

IaC scanners

Code review tooling

Job description

Nabla in Paris is seeking a Senior Security Engineer to bring AppSec expertise to product squads and strengthen security across cloud, CI/CD, and AI features. You’ll own threat modeling, code reviews, vulnerability triage, and secure-by-default libraries, partnering with developers to build robust protections for PHI and patient data.

The role blends hands-on engineering with security design and cross-team collaboration.