Security GRC Lead

Key Responsibilities: 1) Compliance Automation & Engineering Develop automated scripts and API integrations to collect compliance evidence directly from system sources instead of collecting manual screenshots. Write and deploy infrastructure-as-code and policy enforcement rules to enforce security baselines automatically. Maintain live compliance dashboards and alerts that flag configuration drift or policy violations in real time. Partnering with Legal on Medicare and Medicaid compliance Partnering closely with legal and finance teams on future due diligence and compliance projects 2) Framework Mapping & Control Architecture Convert regulatory, security, and industry standards (SOC 2, HiTrust, PCI, HIPAA) into clear, testable technical controls. Map single technical controls across multiple overlapping frameworks to eliminate redundant work. Work alongside DevOps and Software Engineering teams to build compliance controls directly into CI/CD pipelines without slowing down delivery. 3) Risk Management & Audits Lead technical audit readiness and external audit engagements using programmatic evidence pipelines. Automate vendor risk management workflows and API-driven vendor evaluations. Build continuous risk tracking tools fed by live vulnerability telemetry and identity logs rather than static quarterly surveys.

Required Qualifications: 3+ years in a technical security role, such as Security Engineering, Cloud Security, or Technical GRC. Proficiency in Python, TypeScript, SQL and hands on experience interacting with APIs, parsing logs, and querying databases. Hands-on experience with at least one primary cloud platform, GCP Preferred and Infrastructure-as-Code tools such as Terraform Deep familiarity with core frameworks such as SOC 1/2, PCI, NIST, and/or HITRUST. Understanding of CI/CD pipelines, Git workflows, and container environments (Docker/Kubernetes).

Preferred Qualifications: Certifications such as CISSP, CISA, CRISC, AWS Certified Security – Specialty, or CCSP. Experience with Policy-as-Code engines HITRUST experience Background in software development, DevOps, or platform engineering. Experience with modern continuous compliance platforms (e.g., Vanta, Drata, Anecdotes).

Our Values: We spend at least as much time with our coworkers as we do with our closest friends + family - if we intend to do the most important + challenging work of our lives, it's important that these folks energize us, support us, inspire us, and push us to do our best work. This is what you can expect of your teammates at Candid (in no particular order): We put our customers first We take care of each other and ourselves We anchor on outcomes and work relentlessly and creatively to achieve them We collectively prioritize building a diverse and inclusive workspace We believe humility is our greatest strength We are candid, kind, and committed We strive to be the most prepared person in the room We are truth seekers Pay Transparency The estimated starting annual salary range for this position is $180,000 - 258,000 USD. The listed range is a guideline from Pave data, and the actual base salary may be modified based on factors including job-related skills, experience/qualifications, interview performance, market data, etc. Total compensation for this position may also include equity, sales incentives (for sales roles), and employee benefits. Given Candid Health's funding and size, we heavily value the potential upside from equity in our compensation package. Further note that Candid Health has minimal hierarchy and titles, but has broad ranges of experience represented within roles.