Security GRC Lead: Compliance-as-Code & Automation

Candid Health; United States; On-site; USD 120,000 - 160,000; Full time

Job summary

Candid Health seeks a Security GRC Lead to build our first in-house GRC program. You will automate evidence collection, implement policy-as-code, and monitor controls across our cloud and CI/CD stack.

You will translate frameworks (SOC 2, HIPAA, PCI) into measurable technical controls, drive audit readiness, and partner with Legal/Finance on due diligence. Expect an engineering mindset and rapid delivery.

Qualifications

• 3+ years in a technical security role.
• Hands-on with GCP or other cloud platforms and IaC tools.
• Experience with CI/CD pipelines, container environments (Docker/Kubernetes).
• Proficient in Python, TypeScript, SQL and API interaction.
• Experience with policy-as-code and modern compliance platforms (Vanta/Drata).
• Background in software development, DevOps, or platform engineering.
• Certifications such as CISSP, CISA, CRISC, CCSP or AWS Security Specialty.

Responsibilities

• Develop automated scripts and API integrations to collect evidence from system sources.
• Write and deploy infrastructure-as-code and policy enforcement rules.
• Maintain live compliance dashboards and real-time alerts for drift and violations.
• Map regulatory standards into clear, testable technical controls.
• Work with DevOps to embed compliance controls into CI/CD pipelines.
• Lead audit readiness and external engagements with programmatic evidence.
• Automate vendor risk management workflows and API-driven evaluations.
• Build risk tracking tools using live vulnerability telemetry and identity logs.

Skills

Security Engineering

Cloud Security

GRC

CI/CD

Python

TypeScript

SQL

APIs

Tools

Terraform

Docker

Kubernetes

Vanta

Drata

Job description

Candid Health seeks a Security GRC Lead to build our first in-house GRC program. You will automate evidence collection, implement policy-as-code, and monitor controls across our cloud and CI/CD stack.

You will translate frameworks (SOC 2, HIPAA, PCI) into measurable technical controls, drive audit readiness, and partner with Legal/Finance on due diligence. Expect an engineering mindset and rapid delivery.