Security Engineer, GRC

San Francisco · Remotefull time

Apply on Employer Site

Remote

mid

H1B: no

Candid Health The Security Engineer, GRC at Candid Health builds the first in-house Governance, Risk, and Compliance program, treating compliance as an engineering and data problem. The role focuses on automating compliance evidence collection and establishing continuous controls monitoring.

Responsibilities

We are seeking a Security GRC Lead to build our first in-house GRC program from the ground up. In this role, you won't just write policies or collect manual screenshots in spreadsheets; you will treat compliance as an engineering and data problem.
Compliance Automation & Engineering
Develop automated scripts and API integrations to collect compliance evidence directly from system sources instead of collecting manual screenshots.
Write and deploy infrastructure-as-code and policy enforcement rules to enforce security baselines automatically.
Maintain live compliance dashboards and alerts that flag configuration drift or policy violations in real time.
Partnering with Legal on Medicare and Medicaid compliance
Partnering closely with legal and finance teams on future due diligence and compliance projects
Framework Mapping & Control Architecture
Convert regulatory, security, and industry standards (SOC 2, HiTrust, PCI, HIPAA) into clear, testable technical controls.
Map single technical controls across multiple overlapping frameworks to eliminate redundant work.
Work alongside DevOps and Software Engineering teams to build compliance controls directly into CI/CD pipelines without slowing down delivery.
Risk Management & Audits

Qualification

3+ years in a technical security roleProficiency in PythonUnderstanding of CI/CD pipelinesCertifications such as CISSPExperience with Policy-as-Code enginesHITRUST experienceBackground in software developmentWe put our customers first

Required

3+ years in a technical security role, such as Security Engineering, Cloud Security, or Technical GRC.
Proficiency in Python, TypeScript, SQL and hands on experience interacting with APIs, parsing logs, and querying databases.
Hands-on experience with at least one primary cloud platform, GCP Preferred and Infrastructure-as-Code tools such as Terraform
Deep familiarity with core frameworks such as SOC 1/2, PCI, NIST, and/or HITRUST.
Understanding of CI/CD pipelines, Git workflows, and container environments (Docker/Kubernetes).

Preferred

Certifications such as CISSP, CISA, CRISC, AWS Certified Security – Specialty, or CCSP.
Experience with Policy-as-Code engines
HITRUST experience
Background in software development, DevOps, or platform engineering.
Experience with modern continuous compliance platforms (e.g., Vanta, Drata, Anecdotes).
We spend at least as much time with our coworkers as we do with our closest friends + family - if we intend to do the most important + challenging work of our lives, it’s important that these folks energize us, support us, inspire us, and push us to do our best work. This is what you can expect of your teammates at Candid (in no particular order):
We put our customers first
We take care of each other and ourselves