{"id":462473,"url":"https://alion.io/job/candid-health-security-grc-lead","title":"Security GRC Lead","company":{"id":178034,"name":"Candid Health","domain":"candidhealth.com","url":"https://alion.io/company/candid-health-2","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":81,"open_postings":30,"ghost_share":0.233,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":62,"computed_at":"2026-11-05T05:54:30Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States","Denver, United States","New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":180000,"max":258000,"currency":"USD","period":"year","gross":null,"usd_annual":258000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"Docker","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"HIPAA","optional":false},{"name":"Kubernetes","optional":false},{"name":"Python","optional":false},{"name":"SOC 2","optional":false},{"name":"SQL","optional":false},{"name":"Terraform","optional":false},{"name":"TypeScript","optional":false},{"name":"AWS","optional":true},{"name":"Platform Engineering","optional":true}],"status":"live","first_seen_at":"2026-08-25T20:21:39Z","employer_posted_date":"2026-08-25","last_verified_at":"2026-11-05T23:22:44Z","board_verified":true,"closed_at":null,"days_open":72,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":71},"description":"About Candid Health\nIn simple terms, healthcare in the U.S. has a massive, invisible problem behind the scenes: getting doctors paid by insurance companies is notoriously complicated. Insurance rules are constantly changing, and every bill (or \"claim\") requires mountains of paperwork. When mistakes happen, bills get rejected, patients end up with unexpected charges, and healthcare providers waste billions of dollars and countless hours on administrative bureaucracy instead of focusing on patient care.\nThat is where Candid Health steps in. Founded by former Palantir leaders who experienced these pain points firsthand, we are building the modern financial backbone for American healthcare. Instead of relying on decades-old legacy software or attempting to patch broken systems with superficial tools, we've rebuilt the underlying infrastructure from the ground up.\nOur core product is an autonomous Revenue Cycle Management (RCM) platform. Powered by AI agents and a configurable rules engine, the platform unifies clinical, billing, and insurance data into a single smart system. It acts like an intelligent, automated back-office that handles complex medical claims from start to finish-submitting them accurately on the first pass, cutting down administrative costs, and dramatically increasing cash flow for healthcare providers.\nToday, we are trusted by over 200 fast-growing healthcare organizations-from digital health innovators to large enterprise medical groups-processing billions in claims annually. Backed by top investors like Sixth Street Growth, Oak HC/FT, 8VC, and Y Combinator, Candid Health recently raised a $120 million Series D to fuel the AI-driven transformation of healthcare payments and eliminate administrative friction for good.\nRole Overview\nWe are seeking a Security GRC Lead to build our first in-house GRC program from the ground up. In this role, you won't just write policies or collect manual screenshots in spreadsheets; you will treat compliance as an engineering and data problem.\nYou will build automated evidence pipelines, implement compliance-as-code, and establish continuous controls monitoring across our GCP infrastructure, identity systems, and CI/CD pipelines. You will turn point-in-time audits into a continuous compliance telemetry system that keeps our platform secure, resilient, and audit-ready at all times.\nKey Responsibilities\n1) Compliance Automation & Engineering\nDevelop automated scripts and API integrations to collect compliance evidence directly from system sources instead of collecting manual screenshots.\n\nWrite and deploy infrastructure-as-code and policy enforcement rules to enforce security baselines automatically.\n\nMaintain live compliance dashboards and alerts that flag configuration drift or policy violations in real time.\n\nPartnering with Legal on Medicare and Medicaid compliance\n\nPartnering closely with legal and finance teams on future due diligence and compliance projects\n\n2) Framework Mapping & Control Architecture\nConvert regulatory, security, and industry standards (SOC 2, HiTrust, PCI, HIPAA) into clear, testable technical controls.\n\nMap single technical controls across multiple overlapping frameworks to eliminate redundant work.\n\nWork alongside DevOps and Software Engineering teams to build compliance controls directly into CI/CD pipelines without slowing down delivery.\n\n3) Risk Management & Audits\nLead technical audit readiness and external audit engagements using programmatic evidence pipelines.\n\nAutomate vendor risk management workflows and API-driven vendor evaluations.\n\nBuild continuous risk tracking tools fed by live vulnerability telemetry and identity logs rather than static quarterly surveys.\n\nRequired Qualifications\n3+ years in a technical security role, such as Security Engineering, Cloud Security, or Technical GRC.\n\nProficiency in Python, TypeScript, SQL and hands on experience interacting with APIs, parsing logs, and querying databases.\n\nHands-on experience with at least one primary cloud platform, GCP Preferred and Infrastructure-as-Code tools such as Terraform\n\nDeep familiarity with core frameworks such as SOC 1/2, PCI, NIST, and/or HITRUST.\n\nUnderstanding of CI/CD pipelines, Git workflows, and container environments (Docker/Kubernetes).\n\nPreferred Qualifications\nCertifications such as CISSP, CISA, CRISC, AWS Certified Security - Specialty, or CCSP.\n\nExperience with Policy-as-Code engines\n\nHITRUST experience\n\nBackground in software development, DevOps, or platform engineering.\n\nExperience with modern continuous compliance platforms (e.g., Vanta, Drata, Anecdotes).\n\nOur values\nWe spend at least as much time with our coworkers as we do with our closest friends + family - if we intend to do the most important + challenging work of our lives, it’s important that these folks energize us, support us, inspire us, and push us to do our best work. This is what you can expect of your teammates at Candid (in no particular order):\nWe put our customers first\n\nWe take care of each other and ourselves\n\nWe anchor on outcomes and work relentlessly and creatively to achieve them\n\nWe collectively prioritize building a diverse and inclusive workspace\n\nWe believe humility is our greatest strength\n\nWe are candid, kind, and committed\n\nWe strive to be the most prepared person in the room\n\nWe are truth seekers\n\nPay Transparency\nThe estimated starting annual salary range for this position is $180,000 - 258,000 USD. The listed range is a guideline from Pave data, and the actual base salary may be modified based on factors including job-related skills, experience/qualifications, interview performance, market data, etc. Total compensation for this position may also include equity, sales incentives (for sales roles), and employee benefits. Given Candid Health’s funding and size, we heavily value the potential upside from equity in our compensation package. Further note that Candid Health has minimal hierarchy and titles, but has broad ranges of experience represented within roles.","description_format":"text","description_chars":6022,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Health Care","Revenue Cycle & Medical Billing"],"lifecycle":[{"event":"open","at":"2026-09-06T11:27:38Z"}],"visa":[],"liveness":{"score":35,"band":"fade","label":"Fading","p_open":1,"p_active":0.785,"p_room":0.44,"age_days":71,"expected_fill_days":62,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-11-05T05:54:30Z"},"pay":{"stated_usd_annual":258000,"is_top_pay":true},"html_url":"https://alion.io/job/candid-health-security-grc-lead","json_url":"https://alion.io/job/candid-health-security-grc-lead.json","meta":{"generated_at":"2026-11-05T23:43:15Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5175,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":178034},"rest":"https://alion.io/mcp/rest/get_company?id=178034"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcandid-health-security-grc-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcandid-health-security-grc-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcandid-health-security-grc-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/candid-health-security-grc-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcandid-health-security-grc-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":462473}},{"tool":"search_jobs","arguments":{"company":"candidhealth.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":462473},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}