{"id":462505,"url":"https://alion.io/job/candid-health-product-security-engineer","title":"Application Security Engineer","company":{"id":178034,"name":"Candid Health","domain":"candidhealth.com","url":"https://alion.io/company/candid-health-2","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":81,"open_postings":29,"ghost_share":0.241,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":62,"computed_at":"2026-11-03T05:54:40Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":180000,"max":258000,"currency":"USD","period":"year","gross":null,"usd_annual":258000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"Go","optional":false},{"name":"JavaScript","optional":false},{"name":"Kubernetes","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Shift-Left Security","optional":false},{"name":"Threat Modeling","optional":false},{"name":"CloudFormation","optional":true},{"name":"HIPAA","optional":true},{"name":"ISO 27001","optional":true},{"name":"SOC 2","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-05-18T19:23:44Z","employer_posted_date":"2026-05-18","last_verified_at":"2026-11-04T02:55:49Z","board_verified":true,"closed_at":null,"days_open":169,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":169},"description":"About Candid Health\nIn simple terms, healthcare in the U.S. has a massive, invisible problem behind the scenes: getting doctors paid by insurance companies is notoriously complicated. Insurance rules are constantly changing, and every bill (or \"claim\") requires mountains of paperwork. When mistakes happen, bills get rejected, patients end up with unexpected charges, and healthcare providers waste billions of dollars and countless hours on administrative bureaucracy instead of focusing on patient care.\nThat is where Candid Health steps in. Founded by former Palantir leaders who experienced these pain points firsthand, we are building the modern financial backbone for American healthcare. Instead of relying on decades-old legacy software or attempting to patch broken systems with superficial tools, we've rebuilt the underlying infrastructure from the ground up.\nOur core product is an autonomous Revenue Cycle Management (RCM) platform. Powered by AI agents and a configurable rules engine, the platform unifies clinical, billing, and insurance data into a single smart system. It acts like an intelligent, automated back-office that handles complex medical claims from start to finish-submitting them accurately on the first pass, cutting down administrative costs, and dramatically increasing cash flow for healthcare providers.\nToday, we are trusted by over 200 fast-growing healthcare organizations-from digital health innovators to large enterprise medical groups-processing billions in claims annually. Backed by top investors like Sixth Street Growth, Oak HC/FT, 8VC, and Y Combinator, Candid Health recently raised a $120 million Series D to fuel the AI-driven transformation of healthcare payments and eliminate administrative friction for good.\nRole Overview\nWe are looking for a Product Security Engineer to join our team and act as a champion for security within our product engineering organization. You will be responsible for ensuring our products are designed, developed, and maintained with security as a core pillar. You will work in partnership with development squads to perform threat modeling, guide secure architecture decisions, and automate security gates in our CI/CD pipelines.\nKey Responsibilities\nSecurity by Design: Lead threat modeling sessions during the architectural design phase of new features to identify potential risk vectors early.\n\nSecure Development Lifecycle (SDLC): Drive the adoption of \"Shift Left\" security practices, integrating security tooling (SAST, DAST, SCA) directly into developer workflows.\n\nVulnerability Management: Triage, prioritize, and partner with engineering teams to remediate vulnerabilities found in code, third-party libraries, and cloud infrastructure.\n\nSecurity Tooling & Automation: Build, maintain, and tune security automation tools to reduce friction for developers while maintaining high-security standards.\n\nSecure Coding Standards: Develop and deliver training, coding patterns, and security guardrails to help engineering teams build resilient, secure-by-default products.\n\nIncident Response Support: Assist in identifying the root cause of security incidents related to product features and contribute to post-incident remediation and architectural improvements.\n\nSupply Chain Security: Build out processes and automation to ensure the security of open-source dependencies.\n\nRequired Qualifications\nExperience: 5+ years of experience in software engineering or security engineering, specifically focusing on product security or application security.\n\nTechnical Skills:\nProficiency in one or more programming languages (e.g., Python, Go, Java, or JavaScript).\n\nDeep understanding of modern web/cloud architecture (e.g., APIs, Microservices, Kubernetes, AWS/GCP/Azure).\n\nFamiliarity with the OWASP Top 10 and common exploitation techniques.\n\nCollaboration: Proven ability to influence and collaborate with engineering teams without hindering development velocity.\n\nProblem Solving: Strong analytical skills to evaluate complex systems and design innovative, practical security solutions.\n\nPreferred Skills (Nice to Have)\nExperience with Infrastructure as Code (IaC) security (e.g., Terraform, CloudFormation).\n\nExperience in designing cryptographic implementations or secure authentication/authorization flows (e.g., OAuth, OIDC, JWT).\n\nKnowledge of compliance frameworks relevant to our industry (e.g., SOC2, ISO27001, HIPAA).\n\nPay Transparency\nThe estimated starting annual salary range for this position is $180,000 - 258,000 USD. The listed range is a guideline from Pave data, and the actual base salary may be modified based on factors including job-related skills, experience/qualifications, interview performance, market data, etc. Total compensation for this position may also include equity, sales incentives (for sales roles), and employee benefits. Given Candid Health’s funding and size, we heavily value the potential upside from equity in our compensation package. Further note that Candid Health has minimal hierarchy and titles, but has broad ranges of experience represented within roles.","description_format":"text","description_chars":5093,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Health Care","Revenue Cycle & Medical Billing"],"lifecycle":[{"event":"open","at":"2026-09-06T11:27:38Z"}],"visa":[],"liveness":{"score":15,"band":"cold","label":"Long shot","p_open":1,"p_active":0.533,"p_room":0.28,"age_days":168,"expected_fill_days":62,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-11-03T05:54:40Z"},"pay":{"stated_usd_annual":258000,"is_top_pay":true},"html_url":"https://alion.io/job/candid-health-product-security-engineer","json_url":"https://alion.io/job/candid-health-product-security-engineer.json","meta":{"generated_at":"2026-11-04T06:17:22Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9785,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":178034},"rest":"https://alion.io/mcp/rest/get_company?id=178034"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcandid-health-product-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcandid-health-product-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcandid-health-product-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/candid-health-product-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcandid-health-product-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":462505}},{"tool":"search_jobs","arguments":{"company":"candidhealth.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":462505},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}