> Markdown version of [/jobs/ext/4523206-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4523206-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer

- **Company:** Candid Health
- **Location:** Daly City, CA, United States
- **Experience:** Expert
- **Salary:** $180,000.0 - $258,000.0
- **Contract:** Permanent contract
- **Skills:** Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, User Authentication, Microsoft Azure, Cloud Computing, Cloud Engineering, Python (Programming Language), OAuth, Open Source Technology, OpenID, Open Web Application Security, Systems Development Life Cycle, JSON Web Token, Secure Coding, Service Pack, Software Engineering, Software Vulnerability Management, Software Security, Infrastructure as Code (IaC), Cloudformation, Kubernetes, Terraform, Security Orchestration, Automation & Response, Static Application Security Testing, Golang, Programming Languages, Microservices, Dynamic Application Security Testing
- **Published:** November 2, 2026
- **Apply:** https://www.careerbuilder.com/job-details/application-security-engineer-san-francisco-ca--d0603640-2815-4724-b43e-048bcbf8ed9f

## About the Role

Applications Security, Software Engineering, Insurance, Healthcare, Patient Care, Healthcare Providers, Medical Billing, Software Patches, Artificial Intelligence (AI) Agents, Semantic Reasoner, * Experience: 5+ years of experience in software engineering or security engineering, specifically focusing on product security or application security.

 * Technical Skills:
 * Proficiency in one or more programming languages (e.g., Python, Go, Java, or JavaScript).
 * Deep understanding of modern web/cloud architecture (e.g., APIs, Microservices, Kubernetes, AWS/GCP/Azure).
 * Familiarity with the OWASP Top 10 and common exploitation techniques.
 * Collaboration: Proven ability to influence and collaborate with engineering teams without hindering development velocity.
 * Problem Solving: Strong analytical skills to evaluate complex systems and design innovative, practical security solutions.

Preferred Skills (Nice to Have)

 * Experience with Infrastructure as Code (IaC) security (e.g., Terraform, CloudFormation).
 * Experience in designing cryptographic implementations or secure authentication/authorization flows (e.g., OAuth, OIDC, JWT).
 * Knowledge of compliance frameworks relevant to our industry (e.g., SOC2, ISO27001, HIPAA).

## Description

In simple terms, healthcare in the U.S. has a massive, invisible problem behind the scenes: getting doctors paid by insurance companies is notoriously complicated. Insurance rules are constantly changing, and every bill (or "claim") requires mountains of paperwork. When mistakes happen, bills get rejected, patients end up with unexpected charges, and healthcare providers waste billions of dollars and countless hours on administrative bureaucracy instead of focusing on patient care., We are looking for a Product Security Engineer to join our team and act as a champion for security within our product engineering organization. You will be responsible for ensuring our products are designed, developed, and maintained with security as a core pillar. You will work in partnership with development squads to perform threat modeling, guide secure architecture decisions, and automate security gates in our CI/CD pipelines., * Security by Design: Lead threat modeling sessions during the architectural design phase of new features to identify potential risk vectors early.

 * Secure Development Lifecycle (SDLC): Drive the adoption of "Shift Left" security practices, integrating security tooling (SAST, DAST, SCA) directly into developer workflows.
 * Vulnerability Management: Triage, prioritize, and partner with engineering teams to remediate vulnerabilities found in code, third-party libraries, and cloud infrastructure.
 * Security Tooling & Automation: Build, maintain, and tune security automation tools to reduce friction for developers while maintaining high-security standards.
 * Secure Coding Standards: Develop and deliver training, coding patterns, and security guardrails to help engineering teams build resilient, secure-by-default products.
 * Incident Response Support: Assist in identifying the root cause of security incidents related to product features and contribute to post-incident remediation and architectural improvements.
 * Supply Chain Security: Build out processes and automation to ensure the security of open-source dependencies.