Security Engineer, GRC

Candid Health; San Francisco (CA); On-site; USD 140,000 - 180,000; Full time

Job summary

Candid Health is building an in-house GRC program and automated evidence pipelines to support continuous compliance across the GCP infrastructure, identity systems, and CI/CD pipelines.

You will engineer policy enforcement and dashboards, drive framework mappings (SOC 2, HIPAA, PCI, HiTrust), and enable automated audits with vendor risk workflows. This role focuses on security engineering and DevOps collaboration in a fast-paced healthcare tech environment.

Qualifications

• 3+ years in a technical security role.
• Proficiency in Python, TypeScript, SQL.
• Hands-on with APIs, logs, and databases.
• Experience with at least one cloud platform (GCP preferred).
• Infrastructure-as-Code tools such as Terraform.
• Familiar with CI/CD pipelines and container environments (Docker/Kubernetes).

Responsibilities

• Develop automated scripts and evidence pipelines for compliance.
• Implement compliance-as-code and continuous controls monitoring.
• Lead audits and build risk-tracking tools from live telemetry.

Skills

Python

TypeScript

SQL

APIs

Logs

Databases

GCP

Terraform

CI/CD

Git

Docker

Kubernetes

Tools

Terraform

Docker

Kubernetes

CI/CD tools

Git

Job description

About Candid Health

In simple terms, healthcare in the U.S. has a massive, invisible problem behind the scenes: getting doctors paid by insurance companies is notoriously complicated. Insurance rules are constantly changing, and every bill (or "claim") requires mountains of paperwork. When mistakes happen, bills get rejected, patients end up with unexpected charges, and healthcare providers waste billions of dollars and countless hours on administrative bureaucracy instead of focusing on patient care. That is where Candid Health steps in. Founded by former Palantir leaders who experienced these pain points firsthand, we are building the modern financial backbone for American healthcare. Instead of relying on decades-old legacy software or attempting to patch broken systems with superficial tools, we've rebuilt the underlying infrastructure from the ground up. Our core product is an autonomous Revenue Cycle Management (RCM) platform. Powered by AI agents and a configurable rules engine, the platform unifies clinical, billing, and insurance data into a single smart system. It acts like an intelligent, automated back-office that handles complex medical claims from start to finish—submitting them accurately on the first pass, cutting down administrative costs, and dramatically increasing cash flow for healthcare providers. Today, we are trusted by over 200 fast-growing healthcare organizations—from digital health innovators to large enterprise medical groups—processing billions in claims annually. Backed by top investors like Sixth Street Growth, Oak HC/FT, 8VC, and Y Combinator, Candid Health recently raised a $120 million Series D to fuel the AI-driven transformation of healthcare payments and eliminate administrative friction for good.

Role Overview

We are seeking a Security GRC Lead to build our first in-house GRC program from the ground up. In this role, you won't just write policies or collect manual screenshots in spreadsheets; you will treat compliance as an engineering and data problem. You will build automated evidence pipelines, implement compliance-as-code, and establish continuous controls monitoring across our GCP infrastructure, identity systems, and CI/CD pipelines. You will turn point-in-time audits into a continuous compliance telemetry system that keeps our platform secure, resilient, and audit-ready at all times.

Key Responsibilities

1. 1) Compliance Automation & EngineeringDevelop automated scripts and API integrations to collect compliance evidence directly from system sources instead of collecting manual screenshots.Write and deploy infrastructure-as-code and policy enforcement rules to enforce security baselines automatically.Maintain live compliance dashboards and alerts that flag configuration drift or policy violations in real time.Partnering with Legal on Medicare and Medicaid compliancePartnering closely with legal and finance teams on future due diligence and compliance projects
2. 2) Framework Mapping & Control ArchitectureConvert regulatory, security, and industry standards (SOC 2, HiTrust, PCI, HIPAA) into clear, testable technical controls.Map single technical controls across multiple overlapping frameworks to eliminate redundant work.Work alongside DevOps and Software Engineering teams to build compliance controls directly into CI/CD pipelines without slowing down delivery.
3. 3) Risk Management & AuditsLead technical audit readiness and external audit engagements using programmatic evidence pipelines.Automate vendor risk management workflows and API-driven vendor evaluations.Build continuous risk tracking tools fed by live vulnerability telemetry and identity logs rather than static quarterly surveys.

Required Qualifications

3+ years in a technical security role, such as Security Engineering, Cloud Security, or Technical GRC. Proficiency in Python, TypeScript, SQL and hands on experience interacting with APIs, parsing logs, and querying databases. Hands-on experience with at least one primary cloud platform, GCP Preferred and Infrastructure-as-Code tools such as TerraformDeep familiarity with core frameworks such asUnderstanding of CI/CD pipelines, Git workflows, and container environments (Docker/Kubernetes).

Preferred Qualifications

Certifications such as CISSP, CISA, CRISC, AWS Certified Security – Specialty, or CCSP. Experience with Policy-as-Code enginesBackground in software development, DevOps, or platform engineering. Experience with modern continuous compliance platforms (e.g., Vanta, Drata, Anecdotes).