Product Security Engineer

About the role

Candid Health is building an AI‑driven Revenue Cycle Management platform that modernizes healthcare payments. As a Product Security Engineer you will champion security across the product engineering organization, ensuring that security is baked into design, development, and operations.

Key responsibilities

• Lead threat‑modeling sessions during architectural design to surface risk vectors early.
• Drive “Shift‑Left” security by integrating SAST, DAST, and SCA tools into CI/CD pipelines.
• Tri­age and prioritize vulnerabilities in code, third‑party libraries, and cloud infrastructure, working with engineering teams to remediate.
• Build and maintain security automation tools that reduce friction for developers while upholding high security standards.
• Develop secure coding standards, training, and guardrails to enable secure‑by‑default product development.
• Support incident response by investigating root causes of security incidents and guiding post‑mortem improvements.
• Establish supply‑chain security processes for open‑source dependencies.

Required profile

• 5+ years of experience in software or security engineering with a focus on product or application security.
• Proven ability to influence and collaborate with engineering teams without slowing development velocity.
• Strong analytical and problem‑solving skills to evaluate complex systems and design practical security solutions.

Required skills

• Proficiency in Python, Go, Java, or JavaScript.
• Deep knowledge of modern web/cloud architectures: APIs, microservices, Kubernetes, AWS/GCP/Azure.
• Familiarity with OWASP Top 10 and common exploitation techniques.
• Experience with security tooling: SAST, DAST, SCA.
• Knowledge of IaC security tools such as Terraform or CloudFormation.
• Understanding of authentication/authorization standards like OAuth, OIDC, JWT.

What we offer

• Competitive salary range $180,000‑$258,000 per year.
• Equity participation and comprehensive benefits package.