Candid Health
Security GRC Lead
$180K–$258K
San Francisco +2 · Hybrid · Full-time · Posted Aug 25, 2026
- Location
- San Francisco
Denver
New York City - Experience
- 3+ years in a technical security role.
About the job
Build Candid Health’s first in-house security GRC program by automating compliance evidence, embedding technical controls into systems, and maintaining continuous audit readiness.
What you'll do
- Develop automated evidence pipelines, infrastructure-as-code security baselines, compliance dashboards, and real-time alerts.
- Translate regulatory and security frameworks into technical controls and integrate them into CI/CD pipelines.
- Lead technical audit readiness, automate vendor risk workflows, and build continuous risk tracking from vulnerability and identity data.
What they ask for
- 3+ years in a technical security role, such as Security Engineering, Cloud Security, or Technical GRC.
- Proficiency in Python, TypeScript, and SQL, with hands-on API, log-parsing, and database-querying experience.
- Hands-on experience with at least one primary cloud platform and Infrastructure-as-Code tools such as Terraform.
- Deep familiarity with core frameworks such as SOC 1/2, PCI, NIST, and/or HITRUST; understanding of CI/CD, Git workflows, and Docker/Kubernetes environments.
Nice to have
- Certifications such as CISSP, CISA, CRISC, AWS Certified Security – Specialty, or CCSP; experience with Policy-as-Code engines.
- HITRUST, software development, DevOps, platform engineering, or modern continuous compliance platform experience (e.g., Vanta, Drata, Anecdotes).
Pay
$180,000 - 258,000 USD (base salary)
Tools
Python, TypeScript, SQL, GCP, Terraform, Docker, Kubernetes, Vanta
AI focus
The role builds automated compliance and risk systems; it does not specify work on AI.
Model-written summary · the original posting is authoritative