Senior Security Engineer, AppSec for Healthcare AI

Nabla; Paris; On-site; EUR 90,000 - 125,000; Full time

Job summary

Nabla is hiring a Senior Security Engineer to strengthen our AppSec and broader security engineering across our Google Cloud-based platform. You will work closely with developers to embed security from design through deployment, focusing on authentication, authorization, and PHI protection.

The role spans code-security, threat modeling, and security design reviews, with hands-on responsibility across CI/CD, SAST/SCA, and AI/LLM security.

Qualifications

• 5–8+ years in security engineering, incl 2–3 years in application/product security.
• Deep understanding of modern web/API security (OAuth 2.0/OIDC, multi-tenancy, OWASP Top 10).
• Strong coding in production code (Kotlin and Python) and automation in Python.
• Experience running threat modeling and security design reviews, CI with triage loops.
• Fluent in French and English (oral and written).

Responsibilities

• Partner with product squads for design reviews and per-feature threat modeling.
• Secure authentication/authorization surfaces (OAuth, one-time codes, multi-org tenancy).
• Triage and drive backlog of vulnerabilities from SAST, SCA, secrets, IaC scanners.
• Secure AI/LLM features, PHI leakage prevention, and model/API egress controls.
• Run pentests (web, mobile, backoffice) and manage vulnerability disclosure program.
• Build secure-by-default guardrails (guidelines, libraries, pre-commit checks).

Skills

Web security

API security

Threat modeling

CI/CD security

Kotlin

Python

Communication

French fluency

English fluency

Tools

SAST

SCA

Secrets scanning

Job description

Nabla is hiring a Senior Security Engineer to strengthen our AppSec and broader security engineering across our Google Cloud-based platform. You will work closely with developers to embed security from design through deployment, focusing on authentication, authorization, and PHI protection.

The role spans code-security, threat modeling, and security design reviews, with hands-on responsibility across CI/CD, SAST/SCA, and AI/LLM security.