Security GRC Engineer: Automate Compliance at Scale

Candid Health; Denver (CO); On-site; USD 180,000 - 258,000; Full time

Job summary

Candid Health is seeking a Security GRC Lead to build our first in-house GRC program from the ground up. You will engineer automated evidence pipelines, implement compliance-as-code, and establish continuous controls monitoring across our GCP infrastructure, identity systems, and CI/CD pipelines.

You will transform audits into a continuous compliance telemetry system, ensuring the platform remains secure, resilient, and audit-ready while partnering with Legal, Finance, and DevOps teams to map

Qualifications

• 3+ years in a technical security role such as security engineering or GRC.
• Proficiency in Python, TypeScript, and SQL; strong API, log parsing, and database querying skills.
• Hands-on experience with cloud platforms (GCP preferred) and infrastructure-as-code tools like Terraform.

Responsibilities

• Build automated compliance evidence pipelines and CI/CD-integrated controls.
• Develop infrastructure-as-code and policy enforcement to automate security baselines.
• Maintain live compliance dashboards and real-time policy violation alerts.
• Collaborate with Legal on Medicare/Medicaid compliance.
• Lead audits and automate vendor risk management workflows.
• Integrate compliance controls into CI/CD without slowing delivery.

Skills

3+ years in security role

Python

TypeScript

SQL

APIs

GCP

Terraform

CI/CD

Docker

Kubernetes

Tools

Terraform

Job description

Candid Health is seeking a Security GRC Lead to build our first in-house GRC program from the ground up. You will engineer automated evidence pipelines, implement compliance-as-code, and establish continuous controls monitoring across our GCP infrastructure, identity systems, and CI/CD pipelines.

You will transform audits into a continuous compliance telemetry system, ensuring the platform remains secure, resilient, and audit-ready while partnering with Legal, Finance, and DevOps teams to map