Security GRC Engineer - Automation & Compliance Platform

candidhealth; United States; On-site; USD 120,000 - 180,000; Full time

Job summary

Candid Health is seeking a Security GRC Lead to build our first in-house GRC program. You will treat compliance as an engineering/data problem, building automated evidence pipelines and policy enforcement within our GCP environment.

Responsibilities include mapping SOC 2, HIPAA, PCI to technical controls, tying CI/CD into security, and leading external audits with automated tooling to keep the platform secure and compliant.

Qualifications

• 3+ years in a technical security role (Security Eng, Cloud Security, or GRC).
• Proficiency in Python, TypeScript, SQL; API interactions and log parsing.
• Hands-on with cloud platforms (GCP preferred) and Infrastructure-as-Code (Terraform).

Responsibilities

• Build automated compliance evidence pipelines and policy enforcement.
• Map standards (SOC 2, HIPAA, PCI, HiTrust) to technical controls.
• Lead audit readiness and vendor risk management with API-driven tooling.

Skills

Python

TypeScript

SQL

APIs

Tools

Terraform

GCP

Job description

Candid Health is seeking a Security GRC Lead to build our first in-house GRC program. You will treat compliance as an engineering/data problem, building automated evidence pipelines and policy enforcement within our GCP environment.

Responsibilities include mapping SOC 2, HIPAA, PCI to technical controls, tying CI/CD into security, and leading external audits with automated tooling to keep the platform secure and compliant.