Nabla медицина саласына арналған, клиникалық мамандардың құжаттамаға жұмсайтын уақытын азайтуға бағытталған қоршаған ортаға бейімделген жасанды интеллект бағдарламалық жасақтамасын әзірлейді. Оның көмекшісі клиникалық жұмыс үдерістеріне кіріктіріліп, медицина қызметкерлеріне әкімшілік тапсырмаларға аз уақыт бөліп, пациенттермен көбірек жұмыс істеуге көмектеседі. Компания платформасын 100-ден астам денсаулық сақтау ұйымындағы 50 000-нан астам клиникалық маман пайдаланады, ал хабарланған уақыт үнемі күніне орта есеппен екі сағатты құрайды.
Senior Application Security Engineer
Protect Nabla’s healthcare AI platform and clinical data by strengthening application security, cloud safeguards, and secure AI agent practices.
Сипаттама
- Advise product teams through security design reviews and feature threat modeling, including authentication, authorization, token, and session choices.
- Protect OAuth clients, one-time codes, multi-organization tenancy, Core API user endpoints, and embedded SDKs using postMessage.
- Find BOLA, IDOR, and other broken access-control vulnerabilities.
- Review and prioritize results from SAST, SCA, secrets and infrastructure-as-code scanners, and AI-assisted code review.
- Assign findings to owners with SLAs and reduce the dependency vulnerability backlog.
- Implement security fixes directly when appropriate.
- Protect AI and LLM features and internal agents from prompt injection, excessive tool or permission access, PHI exposure, de-identification failures, and model or API egress.
- Plan and conduct penetration tests across web, mobile, and back-office systems.
- Verify remediation and manage the vulnerability disclosure program.
- Launch a bug bounty program.
- Create secure-by-default controls, including coding guidance, hardened libraries and patterns, and pre-commit and pull request checks.
Талаптар
- Bring 5–8+ years of security engineering experience, including 2–3+ years in application or product security, or software engineering experience with a strong security focus.
- Understand modern web and API security deeply, including OAuth 2.0/OIDC, session and token design, multi-tenancy, OWASP Top 10, and API Top 10.
- Identify access-control flaws by examining code.
- Write and review production code, primarily in Kotlin and Python, and work across web, mobile, and desktop clients.
- Automate tasks with Python.
- Have experience leading threat modeling and security design reviews.
- Have operated SAST, SCA, and secrets scanning in CI with an effective findings triage process.
- Move comfortably among API design reviews, software supply-chain hardening, and security incidents.
- Communicate effectively and collaborate with engineering, compliance, and IT teams.
- Have full professional proficiency in spoken and written French and English.
Артықшылықтар
- Hybrid work with a Paris office and a remote option from within France.
- Time to exercise during the workday at least three times a week, with options including yoga, running, Pilates, or HIIT.
- Regular team off-sites.
- Opportunities to visit colleagues in cities including New York, Paris, and San Francisco.
- An inclusive and diverse workplace.
- Option to decline interview recording without affecting candidacy.