Senior Security Engineer

Nabla; Paris; On-site; EUR 90,000 - 125,000; Full time

Job summary

Nabla is hiring a Senior Security Engineer to strengthen our AppSec and broader security engineering across our Google Cloud-based platform. You will work closely with developers to embed security from design through deployment, focusing on authentication, authorization, and PHI protection.

The role spans code-security, threat modeling, and security design reviews, with hands-on responsibility across CI/CD, SAST/SCA, and AI/LLM security.

Qualifications

• 5–8+ years in security engineering, incl 2–3 years in application/product security.
• Deep understanding of modern web/API security (OAuth 2.0/OIDC, multi-tenancy, OWASP Top 10).
• Strong coding in production code (Kotlin and Python) and automation in Python.
• Experience running threat modeling and security design reviews, CI with triage loops.
• Fluent in French and English (oral and written).

Responsibilities

• Partner with product squads for design reviews and per-feature threat modeling.
• Secure authentication/authorization surfaces (OAuth, one-time codes, multi-org tenancy).
• Triage and drive backlog of vulnerabilities from SAST, SCA, secrets, IaC scanners.
• Secure AI/LLM features, PHI leakage prevention, and model/API egress controls.
• Run pentests (web, mobile, backoffice) and manage vulnerability disclosure program.
• Build secure-by-default guardrails (guidelines, libraries, pre-commit checks).

Skills

Web security

API security

Threat modeling

CI/CD security

Kotlin

Python

Communication

French fluency

English fluency

Tools

SAST

SCA

Secrets scanning

Job description

About Nabla

We are a team of entrepreneurs, clinicians and engineers committed to bringing back joy to the practice of medicine.

Together with a community of clinician innovators, we’ve harnessed the best of machine learning science to develop Nabla: the leading AI assistant that’s restoring the human connection at the heart of healthcare. By streamlining clinical documentation, Nabla is helping clinicians focus on what matters most - patient care. Today, over 100,000+ clinicians across 130+ healthcare organizations trust Nabla to support how they deliver care every day.

We’re at the start of an ambitious journey: Ambient listening, dictation, coding, and command capabilities are all converging into a proactive assistant that intuitively streamlines clinical and financial workflows.

Backed by a recent $70M Series C, we’re hiring to build the next generation of clinical AI and improve the lives of clinicians and patients everywhere.

This is a great time to join us!

Nabl a is scaling its healthcare AI platform, with more products, integrations and AI agents, and more protected health information (PHI) flowing through them. To keep pace, we're growing our security engineering team and looking for an exceptional Senior Security Engineer .

Our SaaS runs entirely on Google Cloud and handles highly sensitive healthcare data, so security is core to everything we do. Our engineers already ask the right questions every day: can we use a one-time token here? How long should it live? How do we scope this OAuth client? Today they answer with good judgment and a search engine. You'll work directly with our Lead Security Engineer to bring real AppSec expertise into the product squads, and to strengthen security well beyond them.

This is a hands-on, high-impact role. About half your time goes to AppSec , but it is deliberately a broad security engineering role, not a pure code-review or pentest job. You'll regularly cross into platform and cloud, CI/CD and detection, and you'll own problems from start to finish. Code scanning, SCA and AI-driven code review are already running, but there is no AppSec process to undo. The threat-modeling practice, the security review loop, the triage rhythm and the secure-by-default libraries don't exist yet. You'll build them and run them.

If you're pragmatic, love working shoulder to shoulder with developers, and want your work to protect patients' most sensitive data, this role is for you.

Responsibilities

Application security (your core focus)

• Partner with the product squads as their go-to security engineer: design reviews, per-feature threat modeling, and fast, opinionated answers on authN/authZ, tokens and session design.
• Secure our authentication and authorization surfaces (OAuth clients, one-time codes, multi-org tenancy, the Core API user API, embedded/postMessage SDKs) and hunt for BOLA, IDOR and broken access control before attackers do.
• Run the code-security findings loop: triage and prioritize results from our SAST, SCA, secrets and IaC scanners and AI-driven code review, route them to the right owners with SLAs, and drive the dependency-vulnerability backlog down, fixing issues yourself when that's faster.
• Secure our AI/LLM features and internal agents, covering prompt injection, tool and permission scoping for autonomous agents, PHI leakage, de-identification assurance and model/API egress.
• Run the external testing program: scope and run pentests (web, mobile, backoffice), validate fixes, operate our vulnerability disclosure program, and stand up a bug bounty.
• Build secure-by-default guardrails (secure coding guidelines, hardened libraries and patterns, pre-commit and PR checks) so the secure path is the easy path.

Qualifications

• 5 to 8+ years in security engineering, including at least 2 to 3 years in application or product security, or experience as a software engineer with a strong security focus.
• Deep understanding of modern web and API security: OAuth 2.0 / OIDC, session and token design, multi-tenancy, and the OWASP Top 10 and API Top 10. You can find access-control flaws by reading code.
• Strong coder, comfortable reading and fixing production code (mostly Kotlin and Python, plus web, mobile and desktop clients) and automating in Python.
• Experience running threat modeling and security design reviews, and operating SAST, SCA and secrets scanning in CI with a real triage loop, not just a dashboard.
• Genuine breadth: comfortable moving between an API design review, a supply-chain hardening PR and an incident in the same week, and honest about what you don't know yet.
• Excellent communicator who earns developers' trust and works well with engineering, compliance and IT.
• Full professional fluency in French and English (oral and written).

Nice to have: LLM / AI agent security, mobile app security, pentest or bug bounty experience, GCP / GKE, or experience in healthcare or another regulated industry.

Life at Nabla

When you become a part of our company, you join a team of excellence-driven, curious, and genuinely kind individuals. Together, we're committed to making clinicians' lives easier and improving healthcare experiences for everyone. We believe in a world where clinicians can focus on what they were trained to do - caring for their patients, and where no patient feels their visit was rushed.

We come to work excited to leverage AI to do more for clinicians. We’re obsessed with our users’ satisfaction and we actively seek out opportunities to engage one-on-one with clinicians to understand how Nabla can better help. We consistently look for ways to improve and do not shy away from doing the work to excel. Whether it’s a feature our users asked for, or a new article for our blog, we prioritize collaboration to deliver exceptional outcomes.

We love having fun as much as we love work. Our #nablabla channel is as active as our #feature-show-off channel, we exercise during the work day at least 3 times a week (yoga, running, pilates, or HIIT, your choice!), enjoy regular off-sites to gather the team, and travel to see each other in places like NY, Paris, San Francisco, and many other vibrant cities. Oh, and we’re constantly snacking on chocolate or nuts!

If this sounds like an environment you’ll thrive in, we look forward to reading your application!

Our Values at Nabla

Joining Nabla means being part of a team that shares a commitment to excellence, humility, growth, and inclusion.

Every day is a new chance to excel

We aim for nothing less than the best and are willing to put in the effort and dedication required to exceed standards. We learn from yesterday’s failures and do better every day.

Stay humble

There’s no place for ego in our team. Our collective success is more important than individual achievements. We see humility as wisdom — keeping focus on the bigger picture.

Feedback is a gift

We embrace feedback and foster a culture of trust and respect that helps everyone grow. We communicate openly about both achievements and challenges, and we actively involve each other in finding solutions.

Committed to diversity

We recognize the ongoing challenge of diversity in tech. Our responsibility starts with fostering an inclusive environment where everyone feels empowered to be their authentic selves and do their best work.

Diversity & Inclusion

Diversity and inclusivity are fundamental values at Nabla. We embrace individuals from various backgrounds, including race, gender, educational history, sexual orientation, and beyond.

As an equal opportunity employer, we actively seek out and welcome applicants from diverse backgrounds, believing that a wide range of perspectives enriches our team and enhances our ability to innovate and thrive.