Senior Application Security Engineer
Nabla is an active clinical AI company offering ambient documentation, dictation, coding, and agentic workflow tools for healthcare organizations.
Funding history
About Nabla
Nabla builds a unified clinical AI platform that captures clinical conversations, generates structured notes, provides EHR-embedded dictation and coding support, and develops agentic capabilities for clinical and administrative workflows.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will embed application security expertise into product work, partnering with developers on design reviews, threat modeling, authentication, authorization, and secure implementation. You will triage code-security findings, secure AI and LLM features, run external testing and vulnerability disclosure programs, and create guardrails that make secure development easier.
Requirements
- 5 to 8+ years of security engineering experience, including 2 to 3 years in application or product security, or software engineering experience with a strong security focus
- Deep knowledge of web and API security, including OAuth 2.0, OIDC, session and token design, multi-tenancy, OWASP Top 10, and OWASP API Top 10
- Ability to identify access-control flaws through code review
- Ability to read and fix production code, primarily Kotlin and Python
- Python automation skills
- Experience with threat modeling, security design reviews, SAST, SCA, secrets scanning, CI, and vulnerability triage
- Ability to work across API design reviews, supply-chain hardening, and incident response
- Professional fluency in French and English
Responsibilities
- Partner with product squads on design reviews, per-feature threat modeling, and authentication and authorization decisions
- Secure authentication and authorization surfaces and identify access-control vulnerabilities
- Triage and prioritize findings from SAST, SCA, secrets, IaC, and AI-driven code-review tools
- Drive dependency-vulnerability remediation and fix issues when appropriate
- Secure AI and LLM features against prompt injection, improper tool permissions, PHI leakage, de-identification failures, and model or API egress
- Scope and run web, mobile, and back-office penetration tests and validate fixes
- Operate the vulnerability disclosure program and establish a bug bounty
- Build secure coding guidelines, hardened libraries and patterns, and pre-commit and pull-request checks
Benefits
- Well-being activities at least three times per week, including yoga, running, Pilates, and HIIT
- Regular off-sites
- Stocked chocolate and nuts