Senior Application Security Engineer

The role

You will work with the Lead Security Engineer to bring AppSec expertise to product squads and strengthen security across platform, cloud, and CI/CD. You will build threat-modeling practices, security review loops, and secure-by-default libraries.

What you will do

• Partner with product squads for design reviews, threat modeling, and authN/authZ design.
• Secure authentication and authorization surfaces including OAuth clients and multi-org tenancy.
• Hunt for BOLA, IDOR and broken access control.
• Triage and prioritize results from SAST, SCA, secrets and IaC scanners.
• Drive the dependency-vulnerability backlog down.
• Secure AI/LLM features and internal agents covering prompt injection and PHI leakage.
• Run the external testing program including pentests and vulnerability disclosure.
• Stand up a bug bounty program.
• Build secure-by-default guardrails like secure coding guidelines and hardened libraries.

Required qualifications

• 5 to 8+ years in security engineering.
• At least 2 to 3 years in application or product security, or experience as a software engineer with a strong security focus.
• Deep understanding of modern web and API security: OAuth 2.0 / OIDC, session and token design, multi-tenancy, and the OWASP Top 10 and API Top 10.
• Strong coder, comfortable reading and fixing production code in Kotlin and Python.
• Experience running threat modeling and security design reviews.
• Experience operating SAST, SCA and secrets scanning in CI.
• Full professional fluency in French and English (oral and written).

Nice to have

• LLM / AI agent security
• mobile app security
• pentest or bug bounty experience
• GCP / GKE
• experience in healthcare or another regulated industry

Benefits

• Workday activities at least three times a week including yoga, running, Pilates, or HIIT.
• Regular off-sites.
• Chocolate and nuts provided.

About the company

Nabla delivers a unified clinical AI platform used by healthcare organizations across specialties and care settings. The platform includes ambient AI documentation, AI-powered dictation, and agentic AI capabilities.