Senior Application Security Engineer
Remote • Paris office • FullTime
Posted 8h ago
About the job
Nabla is scaling its healthcare AI platform, which handles highly sensitive healthcare data and runs on Google Cloud. We are seeking an exceptional Senior Security Engineer to join our growing security engineering team. This is a hands-on, high-impact role where you will partner directly with the Lead Security Engineer to bring deep AppSec expertise into product squads and strengthen security across the organization. You will be responsible for building and running our AppSec processes, including threat modeling, security reviews, and secure-by-default libraries, and will also contribute to platform, cloud, and CI/CD security. If you are pragmatic, enjoy collaborating with developers, and are passionate about protecting sensitive patient data, this role is for you.
Responsibilities
- Partner with product squads as their go-to security engineer for design reviews, threat modeling, and guidance on authentication/authorization, tokens, and session design.
- Secure authentication and authorization surfaces, including OAuth clients, one-time codes, multi-org tenancy, Core API user API, and embedded/postMessage SDKs, proactively hunting for access control vulnerabilities.
- Manage the code security findings loop: triage, prioritize, and route results from SAST, SCA, secrets, and IaC scanners, and AI-driven code review, driving down the dependency-vulnerability backlog.
- Secure AI/LLM features and internal agents, addressing prompt injection, tool and permission scoping for autonomous agents, PHI leakage, de-identification assurance, and model/API egress.
- Manage the external testing program, including scoping and running penetration tests, validating fixes, operating the vulnerability disclosure program, and establishing a bug bounty program.
- Build secure-by-default guardrails such as secure coding guidelines, hardened libraries and patterns, and pre-commit/PR checks to make secure development the easiest path.
Requirements
- 5 to 8+ years in security engineering, with at least 2 to 3 years in application or product security, or equivalent experience as a software engineer with a strong security focus.
- Deep understanding of modern web and API security, including OAuth 2.0 / OIDC, session and token design, multi-tenancy, and OWASP Top 10/API Top 10.
- Proficient coder, comfortable reading and fixing production code (Kotlin, Python, web, mobile, desktop clients) and automating tasks in Python.
- Experience running threat modeling and security design reviews, and operating SAST, SCA, and secrets scanning in CI with a functional triage loop.
- Demonstrated breadth in security engineering, capable of moving between API design reviews, supply-chain hardening, and incident response within the same week.
- Excellent communication skills, with the ability to build trust with developers and collaborate effectively with engineering, compliance, and IT teams.
- Full professional fluency in both French and English (oral and written).