Senior Application Security Engineer
About Nabla Nabla delivers a unified clinical AI platform used by healthcare organizations across specialties and care settings. The platform includes: Ambient AI documentation that captures clinical conversations and generates structured notes. AI-powered dictation and clinical workflow tools embedded directly within EHR systems. Agentic AI capabilities that support multi-step clinical and administrative tasks. Enterprise-grade infrastructure built for secure deployment across health systems. About the Role We are scaling our healthcare AI platform, with more products, integrations and AI agents, and more protected health information (PHI) flowing through them. To keep pace, we're growing our security engineering team and looking for an exceptional Senior Security Engineer . Our cloud infrastructure handles highly sensitive healthcare data, so security is core to everything we do. Our engineers already ask the right questions every day: can we use a one-time token here? How long should it live? How do we scope this OAuth Client? You'll work directly with our Lead Security Engineer to bring real AppSec expertise into the product squads, and to strengthen security well beyond them. This is a hands-on, high-impact role. About half your time goes to AppSec , but it is deliberately a broad security engineering role, not a pure code-review or pentest job. You'll regularly cross into platform and cloud, CI/CD and detection, and you'll own problems from start to finish. Code scanning, SCA and AI-driven code review are already running, but there is no AppSec process to undo. The threat-modeling practice, the security review loop, the triage rhythm and the secure-by-default libraries don't exist yet. You'll build them and run them. If you're pragmatic, love working shoulder to shoulder with developers, and want your work to protect patients' most sensitive data, this role is for you. Responsibilities Partner with the product squads as their go-to security engineer: design reviews, per-feature threat modeling, and fast, opinionated answers on authN/authZ, tokens and session design. Secure our authentication and authorization surfaces (OAuth clients, one-time codes, multi-org tenancy, the Core API user API, embedded/postMessage SDKs) and hunt for BOLA, IDOR and broken access control before attackers do. Run the code-security findings loop: triage and prioritize results from our SAST, SCA, secrets and IaC scanners and AI-driven code review, route them to the right owners with SLAs, and drive the dependency-vulnerability backlog down, fixing issues yo...
Score the fit and track the next step
Use the checklist as a decision aid, then keep the status and follow-up date with the saved job.
Save the job to keep this score and tracking information in your browser.
Open my full workspace →Applications are completed on the original provider's site. Review the employer and posting before sharing personal information.