Security GRC Lead - Automation & Cloud Compliance

Candid Health; San Francisco (CA); On-site; USD 180,000 - 258,000; Full time

Job summary

Candid Health is building a first-in-house GRC program from the ground up in the United States. This role focuses on turning compliance into an engineering challenge, automating evidence pipelines, and embedding controls into CI/CD and cloud infrastructure.

You will lead automated governance across GCP, identity systems, and pipelines, delivering continuous, auditable compliance as part of a scalable back-end platform for healthcare providers.

Qualifications

• 3+ years in a technical security role, such as Security Engineering, Cloud Security, or Technical GRC.
• Proficiency in Python, TypeScript, SQL and hands on experience interacting with APIs, parsing logs, and querying databases.
• Hands-on experience with at least one primary cloud platform, GCP Preferred and Infrastructure-as-Code tools such as Terraform
• Deep familiarity with core frameworks such as SOC 1/2, PCI, NIST, and/or HITRUST.
• Understanding of CI/CD pipelines, Git workflows, and container environments (Docker/Kubernetes).

Responsibilities

• Develop automated scripts and API integrations to collect compliance evidence directly from system sources instead of collecting manual screenshots.
• Write and deploy infrastructure-as-code and policy enforcement rules to enforce security baselines automatically.
• Maintain live compliance dashboards and alerts that flag configuration drift or policy violations in real time.

Skills

Python

TypeScript

SQL

APIs

CI/CD

Git workflows

Docker

Kubernetes

SOC 2

PCI DSS

NIST

HITRUST

Tools

GCP

Terraform

Job description

Candid Health is building a first-in-house GRC program from the ground up in the United States. This role focuses on turning compliance into an engineering challenge, automating evidence pipelines, and embedding controls into CI/CD and cloud infrastructure.

You will lead automated governance across GCP, identity systems, and pipelines, delivering continuous, auditable compliance as part of a scalable back-end platform for healthcare providers.