Security GRC Lead: Automate Compliance in Cloud CI/CD

Candid Health; New York (NY); On-site; USD 180,000 - 258,000; Full time

Job summary

Candid Health seeks a Security GRC Lead to build our first in-house GRC program from the ground up. You’ll treat compliance as an engineering and data problem, automating evidence pipelines and implementing compliance-as-code across our GCP infrastructure, identity systems, and CI/CD pipelines.

You will turn point-in-time audits into a continuous telemetry system that keeps our platform secure, audit-ready, and resilient, partnering with legal, finance, and DevOps to embed controls into

Qualifications

• 3+ years in a technical security role.
• Proficiency in Python, TypeScript, SQL and APIs.
• Hands-on experience with GCP and Infrastructure-as-Code tools (Terraform).
• Familiarity with CI/CD, Git workflows, and container environments (Docker/Kubernetes).

Responsibilities

• Build automated evidence pipelines for compliance.
• Develop infrastructure-as-code and policy enforcement rules.
• Maintain live compliance dashboards and real-time alerts.
• Collaborate with Legal on Medicare/Medicaid compliance.
• Lead audits and automate vendor risk management workflows.
• Integrate compliance controls into CI/CD pipelines without slowing delivery.

Skills

Python

TypeScript

SQL

APIs

GCP

Terraform

CI/CD

Docker

Kubernetes

Tools

Terraform

GCP

Docker

Kubernetes

Job description

Candid Health seeks a Security GRC Lead to build our first in-house GRC program from the ground up. You’ll treat compliance as an engineering and data problem, automating evidence pipelines and implementing compliance-as-code across our GCP infrastructure, identity systems, and CI/CD pipelines.

You will turn point-in-time audits into a continuous telemetry system that keeps our platform secure, audit-ready, and resilient, partnering with legal, finance, and DevOps to embed controls into