SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Nabla is a healthcare AI platform that delivers ambient AI documentation, clinical workflow tools, and agentic AI capabilities for healthcare organizations. The platform runs on Google Cloud and handles protected health information (PHI) at scale.
You will join the security engineering team as a Senior Application Security Engineer, working directly with the Lead Security Engineer to embed AppSec expertise into product squads and strengthen security across the organization. This is a hands-on, high-impact role that is deliberately broad—roughly half your time focuses on application security, but you will regularly cross into platform security, cloud infrastructure, CI/CD, and detection. You will own problems end-to-end.
Key responsibilities include:
- Partner with product squads as their go-to security engineer, conducting design reviews, per-feature threat modeling, and providing fast, opinionated guidance on authentication, authorization, tokens, and session design.
- Secure authentication and authorization surfaces (OAuth clients, one-time codes, multi-org tenancy, Core API, embedded/postMessage SDKs) and proactively hunt for BOLA, IDOR, and broken access control vulnerabilities.
- Operate the code-security findings loop: triage and prioritize SAST, SCA, secrets, and IaC scanner results; route findings to owners with SLAs; drive down the dependency-vulnerability backlog; and fix issues directly when appropriate.
- Secure AI/LLM features and internal agents, addressing prompt injection, tool and permission scoping for autonomous agents, PHI leakage, de-identification assurance, and model/API egress risks.
- Run the external testing program: scope and execute pentests (web, mobile, backoffice), validate fixes, operate the vulnerability disclosure program, and establish a bug bounty.
- Build secure-by-default guardrails including secure coding guidelines, hardened libraries and patterns, and pre-commit and PR checks to make the secure path the easy path.
The role requires someone pragmatic who loves working shoulder-to-shoulder with developers and is motivated by protecting patients' most sensitive data.
Qualifications:
- 5 to 8+ years in security engineering, including at least 2–3 years in application or product security, or experience as a software engineer with a strong security focus.
- Deep understanding of modern web and API security: OAuth 2.0/OIDC, session and token design, multi-tenancy, OWASP Top 10 and API Top 10. Ability to identify access-control flaws by reading code.
- Strong coder, comfortable reading and fixing production code (primarily Kotlin and Python, plus web, mobile, and desktop clients) and automating in Python.
- Experience running threat modeling and security design reviews, and operating SAST, SCA, and secrets scanning in CI with a real triage loop.
- Genuine breadth: comfortable moving between API design reviews, supply-chain hardening PRs, and incidents in the same week, with honesty about knowledge gaps.
- Excellent communicator who earns developers' trust and works well with engineering, compliance, and IT teams.
- Full professional fluency in French and English (oral and written).
Nice to have: LLM/AI agent security, mobile app security, pentest or bug bounty experience, GCP/GKE, or experience in healthcare or another regulated industry.
About Nabla
Healthcare / Life Sciences; AI / Data / Infrastructure — AI assistant for clinical documentation and patient encounters.
