← All roles

Senior Application Security Engineer

Nabla· Engineering
Apply on company site
Hybrid (Paris office), Hybrid (France: Remote)Full-timePosted 1w ago

About the role

Senior Security Engineer position focused on AppSec within Nabla's healthcare AI platform. Hands-on, high-impact role combining application security, platform/cloud, CI/CD and detection to build secure-by-default guardrails and security processes for PHI-handling systems.

Responsibilities

  • Partner with the product squads as their go-to security engineer: design reviews, per-feature threat modeling, and fast, opinionated answers on authN/authZ, tokens and session design.
  • Secure our authentication and authorization surfaces (OAuth clients, one-time codes, multi-org tenancy, the Core API user API, embedded/postMessage SDKs) and hunt for BOLA, IDOR and broken access control before attackers do.
  • Run the code-security findings loop: triage and prioritize results from our SAST, SCA, secrets and IaC scanners and AI-driven code review, route them to the right owners with SLAs, and drive the dependency-vulnerability backlog down, fixing issues yourself when that's faster.
  • Secure our AI/LLM features and internal agents, covering prompt injection, tool and permission scoping for autonomous agents, PHI leakage, de-identification assurance and model/API egress.
  • Run the external testing program: scope and run pentests (web, mobile, backoffice), validate fixes, operate our vulnerability disclosure program, and stand up a bug bounty.
  • Build secure-by-default guardrails (secure coding guidelines, hardened libraries and patterns, pre-commit and PR checks) so the secure path is the easy path.

Qualifications

  • 5 to 8+ years in security engineering, including at least 2 to 3 years in application or product security, or experience as a software engineer with a strong security focus.
  • Deep understanding of modern web and API security: OAuth 2.0 / OIDC, session and token design, multi-tenancy, and the OWASP Top 10 and API Top 10.
  • Strong coder, comfortable reading and fixing production code (mostly Kotlin and Python, plus web, mobile and desktop clients) and automating in Python.
  • Experience running threat modeling and security design reviews, and operating SAST, SCA and secrets scanning in CI with a real triage loop, not just a dashboard.
  • Genuine breadth: comfortable moving between an API design review, a supply-chain hardening PR and an incident in the same week, and honest about what you don't know yet.
  • Excellent communicator who earns developers' trust and works well with engineering, compliance and IT.
  • Full professional fluency in French and English (oral and written).

Skills

Required:Security engineeringOAuth 2.0 / OIDCCode security
Last updated Oct 14, 2026. Interested? Apply on the company site.

About Nabla

Enjoy care again

The most advanced AI Assistant, restoring the human connection at the heart of healthcare

AI AssistantClinical documentationCliniciansEHR integrationHealthcareheadline-ai-europe-100-2026velocity-racers
Company profileWebsite

More open roles at Nabla