Candidhealth
Application Security Engineer
San Francisco (CA), Denver (CO), New York (NY). Posted 5 months ago
The role
You will act as a champion for security within the product engineering organization. You will perform threat modeling, guide secure architecture decisions, and automate security gates in CI/CD pipelines.
What you will do
- Lead threat modeling sessions during the architectural design phase of new features.
- Drive the adoption of Shift Left security practices by integrating security tooling into developer workflows.
- Triage, prioritize, and partner with engineering teams to remediate vulnerabilities.
- Build, maintain, and tune security automation tools.
- Develop and deliver training, coding patterns, and security guardrails.
- Assist in identifying the root cause of security incidents and contribute to remediation.
- Build out processes and automation to ensure the security of open-source dependencies.
Required qualifications
- 5+ years of experience in software engineering or security engineering, specifically focusing on product security or application security.
- Proficiency in one or more programming languages (e.g., Python, Go, Java, or JavaScript).
- Deep understanding of modern web/cloud architecture (e.g., APIs, Microservices, Kubernetes, AWS/GCP/Azure).
- Familiarity with the OWASP Top 10 and common exploitation techniques.
- Proven ability to influence and collaborate with engineering teams without hindering development velocity.
- Strong analytical skills to evaluate complex systems and design innovative, practical security solutions.
Nice to have
- Experience with Infrastructure as Code (IaC) security (e.g., Terraform, CloudFormation).
- Experience in designing cryptographic implementations or secure authentication/authorization flows (e.g., OAuth, OIDC, JWT).
- Knowledge of compliance frameworks relevant to our industry (e.g., SOC2, ISO27001, HIPAA).
Benefits
- Equity
About the company
Candid Health is building the modern financial backbone for American healthcare. They provide an autonomous Revenue Cycle Management (RCM) platform powered by AI agents.