GRC Automation Engineer: Cloud Security & Compliance

Candid Health; United States; On-site; USD 120,000 - 180,000; Full time

Job summary

Candid Health in United States is seeking a Security GRC Lead to build our first in-house GRC program from the ground up, treating compliance as an engineering and data problem.

You will develop automated evidence pipelines, implement compliance-as-code, and establish continuous controls monitoring across our GCP infrastructure, identity systems, and CI/CD pipelines, turning point-in-time audits into a continuous compliance telemetry system that keeps our platform secure, resilient, and

Qualifications

• 3+ years in a technical security role (Security Engineering/Cloud Security/Tech GRC).
• Hands-on experience with at least one cloud platform (GCP preferred).
• Experience with Terraform or other infrastructure-as-code tools.
• Understanding of CI/CD pipelines, Git workflows, and container environments (Docker/Kubernetes).
• Proficiency in Python, TypeScript, SQL; experience with APIs, logs, and databases.
• Experience with modern continuous compliance platforms (Vanta, Drata, Anecdotes).
• Background in software development, DevOps, or platform engineering.
• Experience with Policy-as-Code engines.
• Certifications such as CISSP, CISA, CRISC, AWS Certified Security – Specialty, or CCSP.

Responsibilities

• Develop automated scripts and API integrations to collect compliance evidence directly from system sources.
• Write and deploy infrastructure-as-code and policy enforcement rules to enforce security baselines automatically.
• Maintain live compliance dashboards and alerts that flag configuration drift or policy violations in real time.
• Lead technical audit readiness and external audit engagements using programmatic evidence pipelines.
• Automate vendor risk management workflows and API-driven vendor evaluations.
• Build continuous risk tracking tools fed by live vulnerability telemetry and identity logs rather than static quarterly surveys.
• Partner with Legal on Medicare and Medicaid compliance, and with finance on due diligence projects.

Skills

Terraform

Docker

Kubernetes

Git workflows

Python

TypeScript

SQL

APIs

Logs querying

Tools

GCP

Policy-as-Code engines

Job description

Candid Health in United States is seeking a Security GRC Lead to build our first in-house GRC program from the ground up, treating compliance as an engineering and data problem.

You will develop automated evidence pipelines, implement compliance-as-code, and establish continuous controls monitoring across our GCP infrastructure, identity systems, and CI/CD pipelines, turning point-in-time audits into a continuous compliance telemetry system that keeps our platform secure, resilient, and