Nabla izstrādā veselības aprūpei paredzētu apkārtējā vidē integrētu mākslīgā intelekta programmatūru, kuras mērķis ir samazināt laiku, ko mediķi velta dokumentēšanai. Tās asistents tiek integrēts klīniskajās darba plūsmās, palīdzot veselības aprūpes speciālistiem mazāk laika pavadīt administratīvu uzdevumu veikšanai un vairāk laika veltīt pacientiem. Uzņēmuma platformu izmanto vairāk nekā 50 000 veselības aprūpes speciālistu vairāk nekā 100 veselības aprūpes organizācijās, un norādītais laika ietaupījums vidēji sasniedz divas stundas dienā.
Senior Application Security Engineer
Protect Nabla’s healthcare AI platform and clinical data by strengthening application security, cloud safeguards, and secure AI agent practices.
Apraksts
- Advise product teams through security design reviews and feature threat modeling, including authentication, authorization, token, and session choices.
- Protect OAuth clients, one-time codes, multi-organization tenancy, Core API user endpoints, and embedded SDKs using postMessage.
- Find BOLA, IDOR, and other broken access-control vulnerabilities.
- Review and prioritize results from SAST, SCA, secrets and infrastructure-as-code scanners, and AI-assisted code review.
- Assign findings to owners with SLAs and reduce the dependency vulnerability backlog.
- Implement security fixes directly when appropriate.
- Protect AI and LLM features and internal agents from prompt injection, excessive tool or permission access, PHI exposure, de-identification failures, and model or API egress.
- Plan and conduct penetration tests across web, mobile, and back-office systems.
- Verify remediation and manage the vulnerability disclosure program.
- Launch a bug bounty program.
- Create secure-by-default controls, including coding guidance, hardened libraries and patterns, and pre-commit and pull request checks.
Prasības
- Bring 5–8+ years of security engineering experience, including 2–3+ years in application or product security, or software engineering experience with a strong security focus.
- Understand modern web and API security deeply, including OAuth 2.0/OIDC, session and token design, multi-tenancy, OWASP Top 10, and API Top 10.
- Identify access-control flaws by examining code.
- Write and review production code, primarily in Kotlin and Python, and work across web, mobile, and desktop clients.
- Automate tasks with Python.
- Have experience leading threat modeling and security design reviews.
- Have operated SAST, SCA, and secrets scanning in CI with an effective findings triage process.
- Move comfortably among API design reviews, software supply-chain hardening, and security incidents.
- Communicate effectively and collaborate with engineering, compliance, and IT teams.
- Have full professional proficiency in spoken and written French and English.
Priekšrocības
- Hybrid work with a Paris office and a remote option from within France.
- Time to exercise during the workday at least three times a week, with options including yoga, running, Pilates, or HIIT.
- Regular team off-sites.
- Opportunities to visit colleagues in cities including New York, Paris, and San Francisco.
- An inclusive and diverse workplace.
- Option to decline interview recording without affecting candidacy.