Candidhealth

Security GRC Lead

San Francisco, Remote. Posted 2 months ago

The role

The Security GRC Lead will build the first in-house GRC program from the ground up. This person will develop automated evidence pipelines, implement compliance-as-code, and establish continuous controls monitoring across GCP infrastructure, identity systems, and CI/CD pipelines.

What you will do

  • Develop automated scripts and API integrations to collect compliance evidence.
  • Write and deploy infrastructure-as-code and policy enforcement rules.
  • Maintain live compliance dashboards and alerts.
  • Partner with Legal on Medicare and Medicaid compliance.
  • Partner with legal and finance teams on future due diligence and compliance projects.
  • Convert regulatory, security, and industry standards into technical controls.
  • Map single technical controls across multiple overlapping frameworks.
  • Work with DevOps and Software Engineering teams to build controls into CI/CD pipelines.
  • Lead technical audit readiness and external audit engagements.
  • Automate vendor risk management workflows and API-driven vendor evaluations.

Required qualifications

  • 3+ years in a technical security role, such as Security Engineering, Cloud Security, or Technical GRC.
  • Proficiency in Python, TypeScript, SQL.
  • Hands on experience interacting with APIs, parsing logs, and querying databases.
  • Hands-on experience with at least one primary cloud platform.
  • Understanding of CI/CD pipelines, Git workflows, and container environments (Docker/Kubernetes).
  • Deep familiarity with core frameworks such as SOC 1/2, PCI, NIST, and/or HITRUST.

Nice to have

  • GCP Preferred
  • Infrastructure-as-Code tools such as Terraform
  • Certifications such as CISSP, CISA, CRISC, AWS Certified Security – Specialty, or CCSP.
  • Experience with Policy-as-Code engines
  • HITRUST experience
  • Background in software development, DevOps, or platform engineering.
  • Experience with modern continuous compliance platforms (e.g., Vanta, Drata, Anecdotes).

Benefits

  • Equity
  • Employee benefits

About the company

Candid Health is building the modern financial backbone for American healthcare through an autonomous Revenue Cycle Management (RCM) platform. The company is trusted by over 200 healthcare organizations and is backed by investors like Sixth Street Growth, Oak HC/FT, 8VC, and Y Combinator.