Security GRC Lead – Build In‑House Compliance Program

About the role

Candid Health is building an AI‑driven Revenue Cycle Management platform and needs a Security GRC Lead to create its first in‑house governance, risk, and compliance program. You will treat compliance as an engineering problem, automating evidence collection and embedding continuous controls across GCP, identity systems, and CI/CD pipelines.

Key responsibilities

• Design and implement automated evidence pipelines, policy‑as‑code, and live compliance dashboards that flag drift or violations in real time.
• Translate frameworks such as SOC 2, HITRUST, PCI, and HIPAA into testable technical controls and embed them directly into CI/CD pipelines without slowing delivery.
• Lead technical audit readiness, external audit engagements, vendor risk automation, and continuous risk tracking using live vulnerability telemetry and identity logs.

Required profile

• 3+ years in a technical security role (e.g., Security Engineering, Cloud Security, Technical GRC).
• Hands‑on experience with GCP and Infrastructure‑as‑Code tools such as Terraform.
• Deep familiarity with compliance frameworks (SOC 1/2, PCI, NIST, HITRUST) and CI/CD, Git, Docker/Kubernetes environments.

Required skills

• Python
• TypeScript
• SQL
• Google Cloud Platform (GCP)
• Terraform
• Docker
• Kubernetes
• Git
• CI/CD pipelines
• Policy‑as‑Code platforms (e.g., Vanta, Drata, Anecdotes)