Security GRC Engineer — Automation & Cloud Compliance

candidhealth; San Francisco (CA); On-site; USD 180,000 - 258,000; Full time

Job summary

Candid Health in San Francisco, CA, seeks a Security GRC Lead to build our first in-house GRC program from the ground up. You will treat compliance as an engineering and data problem, creating automated evidence pipelines and policy-as-code to secure our platform across GCP, identity systems, and CI/CD pipelines.

You’ll turn point-in-time audits into a continuous telemetry system, ensuring ongoing readiness, reducing manual work, and aligning with SOC 2, PCI, HIPAA, and NIST frameworks while

Qualifications

• 3+ years in a technical security role
• Proficiency in Python, TypeScript, SQL and APIs
• Hands-on with at least one cloud platform (GCP preferred) and Terraform
• Familiarity with SOC 1/2, PCI, NIST, HITRUST
• Understanding of CI/CD pipelines, Git workflows, and containers

Responsibilities

• Develop automated scripts and API integrations to collect compliance evidence from system sources
• Write and deploy infrastructure-as-code and policy enforcement rules
• Maintain live compliance dashboards and alerts for real-time drift and violations
• Collaborate with Legal on Medicare and Medicaid compliance
• Map regulatory frameworks to technical controls and integrate into CI/CD pipelines
• Lead audit readiness and external audits with programmatic evidence
• Automate vendor risk management workflows and identity logs tracking

Skills

Security Engineering

Cloud Security

Technical GRC

Python

TypeScript

SQL

APIs

GCP

Terraform

CI/CD

Docker

Kubernetes

Tools

GCP

Terraform

CI/CD

Docker

Kubernetes

Job description

Candid Health in San Francisco, CA, seeks a Security GRC Lead to build our first in-house GRC program from the ground up. You will treat compliance as an engineering and data problem, creating automated evidence pipelines and policy-as-code to secure our platform across GCP, identity systems, and CI/CD pipelines.

You’ll turn point-in-time audits into a continuous telemetry system, ensuring ongoing readiness, reducing manual work, and aligning with SOC 2, PCI, HIPAA, and NIST frameworks while