Security GRC Engineer: Automate Compliance & CI/CD

Candid Health; San Francisco (CA); On-site; USD 140,000 - 200,000; Full time

Job summary

Candid Health is building an autonomous Revenue Cycle Management platform and seeks a Security GRC Lead to design and launch our first in-house GRC program from scratch. You will implement compliance-as-code, automate evidence pipelines, and embed controls into CI/CD on GCP, Docker and Kubernetes to keep the system audit-ready and resilient.

You will collaborate with Legal, Finance and Engineering to map frameworks (SOC 2, HIPAA, PCI) to technical controls and lead audits with programmatic

Qualifications

• 3+ years in a technical security role.
• Proficiency in Python, TypeScript, SQL and APIs.
• Hands-on experience with GCP and Terraform.
• Familiarity with CI/CD pipelines and container environments.

Responsibilities

• Develop automated scripts and API integrations to collect compliance evidence from system sources.
• Write and deploy infrastructure-as-code and policy enforcement rules.
• Maintain live dashboards and alerts for drift and policy violations.
• Collaborate with Legal on Medicare and Medicaid compliance.
• Collaborate with Legal and Finance on due diligence and compliance projects.

Skills

Python

TypeScript

SQL

APIs

CI/CD pipelines

Git workflows

Docker

Kubernetes

Tools

Terraform

Job description

Candid Health is building an autonomous Revenue Cycle Management platform and seeks a Security GRC Lead to design and launch our first in-house GRC program from scratch. You will implement compliance-as-code, automate evidence pipelines, and embed controls into CI/CD on GCP, Docker and Kubernetes to keep the system audit-ready and resilient.

You will collaborate with Legal, Finance and Engineering to map frameworks (SOC 2, HIPAA, PCI) to technical controls and lead audits with programmatic