6 hours ago
Remote, FranceSenior
Responsibilities
- Partner with product squads on security design reviews, per-feature threat modeling, and guidance on authentication, authorization, tokens, and session design.
- Secure OAuth clients, one-time codes, multi-organization tenancy, APIs, embedded SDKs, and postMessage integrations against access-control vulnerabilities.
- Triage and prioritize SAST, SCA, secrets, IaC, and AI-driven code-review findings, assign remediation owners and SLAs, and reduce dependency vulnerabilities.
- Secure AI and LLM features and internal agents against prompt injection, excessive tool or permission scope, PHI leakage, de-identification failures, and unsafe model/API egress.
- Scope and run web, mobile, and back-office penetration tests, validate fixes, operate the vulnerability disclosure program, and establish a bug bounty.
- Build secure-by-default coding guidelines, hardened libraries and patterns, pre-commit checks, and pull-request security checks.
Requirements
- 5 to 8+ years of security engineering experience, including at least 2 to 3 years in application or product security, or software engineering experience with a strong security focus.
- Deep understanding of web and API security, including OAuth 2.0, OIDC, session and token design, multi-tenancy, OWASP Top 10, and API Top 10.
- Strong coding ability with production code, primarily Kotlin and Python, plus web, mobile, and desktop clients; able to automate in Python.
- Experience with threat modeling, security design reviews, and operating SAST, SCA, and secrets scanning in CI with an active triage process.
- Broad security engineering experience across API reviews, software supply-chain hardening, and incident response.
- Strong communication skills and the ability to work effectively with engineering, compliance, and IT teams.
- Full professional fluency in French and English, both oral and written.
- Preferred experience includes LLM or AI-agent security, mobile application security, penetration testing, bug bounty programs, GCP/GKE, or healthcare and other regulated industries.
Benefits
- Workday well-being activities at least three times per week, including yoga, running, Pilates, and HIIT.
- Regular off-sites and opportunities to meet across New York, Paris, San Francisco, and other cities.
- Chocolate and nuts are stocked at the workplace.
- The company emphasizes excellence, humility, growth, inclusion, and diversity.
About Nabla
Nabla builds an ambient AI assistant for clinicians that captures visits, generates notes, and streamlines related tasks through integrations with major EHRs. The software is sold to healthcare organizations and health systems, supporting workflows before, during, and after visits across specialties and languages. Founded in 2018 and headquartered in New York, Nabla is a privately held company focused on clinical documentation and point‑of‑care workflows.