Product Security Engineer
Candid Health5 months ago
Denver, CO, USA +2 moreSenior
Base Salary
$180k - $258k/yr
Responsibilities
- Lead threat modeling sessions during architectural design to identify security risks early.
- Drive shift-left security practices by integrating SAST, DAST, and SCA tooling into developer workflows.
- Triage and prioritize vulnerabilities in code, third-party libraries, and cloud infrastructure, and partner with engineering teams on remediation.
- Build, maintain, and tune security automation tools while minimizing developer friction.
- Develop and deliver secure coding training, patterns, and security guardrails.
- Support investigation of product-related security incidents and contribute to remediation and architectural improvements.
- Build processes and automation to secure open-source dependencies and the software supply chain.
Requirements
- 5+ years of experience in software engineering or security engineering focused on product security or application security.
- Proficiency in one or more of Python, Go, Java, or JavaScript.
- Deep understanding of modern web and cloud architecture, including APIs, microservices, Kubernetes, and AWS, GCP, or Azure.
- Familiarity with the OWASP Top 10 and common exploitation techniques.
- Ability to influence and collaborate with engineering teams without hindering development velocity.
- Strong analytical and problem-solving skills for evaluating complex systems and designing practical security solutions.
- Preferred: experience securing Infrastructure as Code with Terraform or CloudFormation.
- Preferred: experience designing cryptographic implementations or secure authentication and authorization flows such as OAuth, OIDC, or JWT.
- Preferred: knowledge of SOC 2, ISO 27001, or HIPAA compliance frameworks.
Categories
About Candid Health
Candid Health builds revenue cycle management software that automates insurance claims, payments, and related back-office workflows for healthcare providers. It sells a platform and services to ambulatory practices and health systems, aiming to increase net collections and reduce cost to collect through AI-driven claim processing and denials management. The company is privately held and headquartered in San Francisco, serving U.S. healthcare organizations across specialties.