Candid Health
Application Security Engineer
$180K–$258K
San Francisco (CA), Denver (CO), New York (NY) · Full-time · Posted May 18, 2026
- Experience
- 5+ years in software engineering or security engineering, specifically focused on product security or application security.
About the job
The Product Security Engineer partners with product engineering teams to embed security into product design, development, and operations.
What you'll do
- Lead threat modeling and guide secure architecture decisions for new features.
- Integrate and automate security tooling in developer workflows and CI/CD; manage vulnerability remediation and open-source dependency security.
- Develop secure coding guidance and training, and support product-related incident investigations and remediation.
What they ask for
- 5+ years of software engineering or security engineering experience focused on product security or application security.
- Proficiency in one or more programming languages, such as Python, Go, Java, or JavaScript.
- Deep understanding of modern web/cloud architecture and familiarity with the OWASP Top 10 and common exploitation techniques.
- Proven ability to influence and collaborate with engineering teams without hindering development velocity.
Nice to have
- Experience with Infrastructure as Code security, such as Terraform or CloudFormation.
- Experience with cryptographic implementations or secure authentication/authorization flows; knowledge of SOC2, ISO27001, or HIPAA.
Pay
$180,000 - 258,000 USD (annual starting salary range; base salary)
Tools
Python, Go, Java, JavaScript, APIs, Microservices, Kubernetes, AWS/GCP/Azure
Model-written summary · the original posting is authoritative