---
title: 'Senior Application Security Engineer at Nabla'
canonical: 'https://feeny.ai/job/senior-application-security-engineer-nabla-paris-fsnwr5t79xc3'
type: 'job'
last_seen: '2026-10-15'
---

# Senior Application Security Engineer at Nabla

- **Company:** Nabla
- **Location:** Paris, France
- **Employment:** full-time
- **Work type:** hybrid
- **Posted:** 2026-10-14
- **Last confirmed live:** 2026-10-15
- **Apply:** https://jobs.ashbyhq.com/nabla/688fd8c8-7974-4016-8738-9da79a53b96d

## Job description

## About Nabla

Nabla delivers a unified clinical AI platform used by healthcare organizations across specialties and care settings. The platform includes: Ambient AI documentation that captures clinical conversations and generates structured notes. AI-powered dictation and clinical workflow tools embedded directly within EHR systems. Agentic AI capabilities that support multi-step clinical and administrative tasks. Enterprise-grade infrastructure built for secure deployment across health systems.

## About the Role

We are scaling our healthcare AI platform, with more products, integrations and AI agents, and more protected health information (PHI) flowing through them. To keep pace, we're growing our security engineering team and looking for an exceptional Senior Security Engineer. Our cloud infrastructure handles highly sensitive healthcare data, so security is core to everything we do. Our engineers already ask the right questions every day: can we use a one-time token here? How long should it live? How do we scope this OAuth Client? You'll work directly with our Lead Security Engineer to bring real AppSec expertise into the product squads, and to strengthen security well beyond them. This is a hands-on, high-impact role. About half your time goes to AppSec, but it is deliberately a broad security engineering role, not a pure code-review or pentest job. You'll regularly cross into platform and cloud, CI/CD and detection, and you'll own problems from start to finish. Code scanning, SCA and AI-driven code review are already running, but there is no AppSec process to undo. The threat-modeling practice, the security review loop, the triage rhythm and the secure-by-default libraries don't exist yet. You'll build them and run them. If you're pragmatic, love working shoulder to shoulder with developers, and want your work to protect patients' most sensitive data, this role is for you.

## Responsibilities

- Partner with the product squads as their go-to security engineer: design reviews, per-feature threat modeling, and fast, opinionated answers on authN/authZ, tokens and session design.
- Secure our authentication and authorization surfaces (OAuth clients, one-time codes, multi-org tenancy, the Core API user API, embedded/postMessage SDKs) and hunt for BOLA, IDOR and broken access control before attackers do.
- Run the code-security findings loop: triage and prioritize results from our SAST, SCA, secrets and IaC scanners and AI-driven code review, route them to the right owners with SLAs, and drive the dependency-vulnerability backlog down, fixing issues yourself when that's faster.
- Secure our AI/LLM features and internal agents, covering prompt injection, tool and permission scoping for autonomous agents, PHI leakage, de-identification assurance and model/API egress.
- Run the external testing program: scope and run pentests (web, mobile, backoffice), validate fixes, operate our vulnerability disclosure program, and stand up a bug bounty.
- Build secure-by-default guardrails (secure coding guidelines, hardened libraries and patterns, pre-commit and PR checks) so the secure path is the easy path.

## Qualifications

- 5 to 8+ years in security engineering, including at least 2 to 3 years in application or product security, or experience as a software engineer with a strong security focus.
- Deep understanding of modern web and API security: OAuth 2.0 / OIDC, session and token design, multi-tenancy, and the OWASP Top 10 and API Top 10. You can find access-control flaws by reading code.
- Strong coder, comfortable reading and fixing production code (mostly Kotlin and Python, plus web, mobile and desktop clients) and automating in Python.
- Experience running threat modeling and security design reviews, and operating SAST, SCA and secrets scanning in CI with a real triage loop, not just a dashboard.
- Genuine breadth: comfortable moving between an API design review, a supply-chain hardening PR and an incident in the same week, and honest about what you don't know yet.
- Excellent communicator who earns developers' trust and works well with engineering, compliance and IT.
- Full professional fluency in French and English (oral and written).

Nice to have: LLM / AI agent security, mobile app security, pentest or bug bounty experience, GCP / GKE, or experience in healthcare or another regulated industry. Life at Nabla When you join Nabla, you join a team that is driven by excellence, curiousity, and kindness. Together, we’re committed to making clinicians’ lives easier and improving healthcare experiences for everyone. We believe clinicians should be able to focus on what they were trained to do, caring for their patients, and that no patient should feel their visit was rushed. We work hard and make time to have fun, too. Our #nablabla channel is just as active as #feature-show-off. We support well-being with workday activities at least three times a week; choose from yoga, running, Pilates, or HIIT. We also host regular off-sites, meet up across New York, Paris, San Francisco, and other cities, and keep the chocolate and nuts well stocked. If this sounds like an environment where you’ll thrive, we look forward to reading your application.

## Our Values at Nabla

Joining Nabla means being part of a team that shares a commitment to excellence, humility, growth, and inclusion. Every day is a new chance to excel We aim for nothing less than the best and are willing to put in the effort and dedication required to exceed standards. We learn from yesterday’s failures and do better every day. Stay humble There’s no place for ego in our team. Our collective success is more important than individual achievements. We see humility as wisdom — keeping focus on the bigger picture. Feedback is a gift We embrace feedback and foster a culture of trust and respect that helps everyone grow. We communicate openly about both achievements and challenges, and we actively involve each other in finding solutions. Committed to diversity We recognize the ongoing challenge of diversity in tech. Our responsibility starts with fostering an inclusive environment where everyone feels empowered to be their authentic selves and do their best work.

Diversity & Inclusion Diversity and inclusivity are fundamental values at Nabla. We embrace individuals from various backgrounds, including race, gender, educational history, sexual orientation, and beyond. As an equal opportunity employer, we actively seek out and welcome applicants from diverse backgrounds, believing that a wide range of perspectives enriches our team and enhances our ability to innovate and thrive.

Avoid recruitment scams: Stay safe and informed There is an active employment and financial scam which uses Nabla to collect personal information. If you’re contacted by a Nabla recruiter, please ensure they are utilizing a [nabla.com](http://nabla.com) email address. We will never ask for the exchange of any money or credit card details during the recruitment process. Nabla utilizes a hiring platform for all applications; please be aware of any suspicious email activity. You can find more information following this [link](https://consumer.ftc.gov/consumer-alerts/2023/05/scammers-are-hijacking-job-ads-heres-how-spot-fakes).

Nabla does not accept unsolicited CVs from recruiters or employment agencies in response to the Nabla Careers page or a Nabla social media post. Any unsolicited CVs, including those submitted directly to hiring managers, are deemed to be the property of Nabla.

## About Nabla

## Company Overview
- **One-liner**: Nabla builds an ambient AI assistant for clinicians that automatically generates clinical documentation from patient conversations, integrating directly into electronic health records (EHRs).
- **Entity Type**: Private (Series C)
- **Headquarters**: Paris, France (with offices in New York, USA, and Milan, Italy)
- **Founded**: 2018
- **Founders**: Alexandre LeBrun (CEO), Delphine Groll (COO), Martin Raison (CTO)

## Core Business
- **Primary industry**: Healthcare AI / Clinical Intelligence
- **Target customers**: B2B – hospitals, health systems, medical groups, and individual clinicians across 55+ specialties
- **Mission or purpose statement**: "Restoring the joy of medicine" by using AI to support clinicians and elevate patient care, strengthening the human connection at the heart of healthcare.

## Products & Services
- **Nabla Ambient AI Assistant**: An AI-powered platform that listens to clinical conversations in real-time and generates structured, comprehensive clinical notes. It supports ambient AI, dictation, and real-time intelligence, and integrates directly into existing EHR systems. Used across 55+ specialties and 35+ languages.

## Market Standing
- **Valuation/Market Cap**: Not publicly disclosed
- **Key Metric**: Raised a $70M Series C (latest round, announced in 2025). Total funding amount not fully disclosed.
- **Notable Investors/Partners**: Backed by top-tier investors (names not fully listed in available sources, but the company states it is "backed by the best"). Key partnerships include integrations with major EHR vendors and a partnership with the Coalition for Health AI to advance AI governance in healthcare.
- **Growth Signals**: 
  - 85,000+ clinicians using the platform
  - 20M+ patient encounters per year
  - Deployed in 190+ health organizations
  - 27% reduction in clinician burnout reported
  - 1.5x more appointments per month for users
  - 55% more appointments per month reported
  - 81% of users report enhanced patient-clinician interaction
  - KLAS recognized Nabla in 2024 for high customizability and user satisfaction
  - Following the Series C raise, the company states it is "growing faster than ever"

## Competitive Advantages
- **Deep EHR integration**: Nabla embeds directly into existing EHR systems used by leading healthcare organizations, making adoption seamless.
- **Specialty breadth & customization**: Supports 55+ specialties and 35+ languages with extensive customization options, allowing clinicians to tailor the AI to their specific workflows.
- **Enterprise-grade security**: HIPAA and GDPR compliant; SOC 2 Type 2 and ISO 27001 certified; does not train models on customer data; no audio stored by default.
- **Clinician-led development**: Built by AI pioneers and practicing clinicians, ensuring the product meets real-world clinical needs.

## Strategic Focus
- **Expanding beyond documentation**: Nabla is advancing toward delivering "agentic AI" to support multi-step clinical and administrative tasks, moving beyond note-taking to cover the full care journey (preparation, coordination, follow-up).
- **Scaling across health systems**: Following the Series C raise, the company is focused on accelerating deployment across large health systems and medical groups.
- **Global expansion**: With hubs in Paris, New York, and Milan, the company is building a global team to serve an international customer base.

## Why Work Here
- **Culture & values**: Emphasis on curiosity, excellence, humility, and kindness. The company values feedback, collaboration, and a "no ego" environment. Team members describe the culture as "curious, excellence-driven, and genuinely kind."
- **Work model**: Flexible – hybrid and remote options available. Offices in Paris (HQ), New York, and Milan. Many roles are remote-friendly across the U.S. and Europe.
- **Benefits**: Flexible working hours, paid parental leave, regular off-sites, health/dental/vision insurance, company stock options, home office setup budget, competitive pay, and equity reviews.
- **Team**: Brings together world-class engineers, clinicians, and healthcare operators. Founders have backgrounds in AI and healthcare technology.
- **Diversity & inclusion**: The company is committed to fostering an inclusive environment and recognizes the ongoing challenge of diversity in tech.

## Sources
1. [nabla.com](https://www.nabla.com/)
2. [nabla.com/careers](https://www.nabla.com/careers)
3. [nabla.com/about-us](https://www.nabla.com/about-us)
4. [jobs.ashbyhq.com/nabla](https://jobs.ashbyhq.com/nabla)
5. [builtin.com/company/nabla](https://builtin.com/company/nabla)

## Other roles at Nabla

- [Head of Marketing](https://feeny.ai/job/head-of-marketing-nabla-in-the-z6vye1237txz) — IN the, United States
- [Senior Product Designer](https://feeny.ai/job/senior-product-designer-nabla-paris-82r3b31t9vq5) — Paris, France
- [Senior Product Manager - Dictation](https://feeny.ai/job/senior-product-manager-dictation-nabla-paris-twnzb7n1xprn) — Paris, France
- [Enterprise Sales Director](https://feeny.ai/job/enterprise-sales-director-nabla-in-the-1ejz4bkg15yj) — IN the, United States
- [Product Marketing Manager](https://feeny.ai/job/product-marketing-manager-nabla-paris-t3hda2xkvnsn) — Paris, France
- [Senior Product Marketing Manager](https://feeny.ai/job/senior-product-marketing-manager-nabla-in-the-7h45agqysdpq) — IN the, United States
- [Mid-Market Account Executive](https://feeny.ai/job/mid-market-account-executive-nabla-in-the-qg0dbexw1ch3) — IN the, United States
- [Growth Marketing Director](https://feeny.ai/job/growth-marketing-director-nabla-in-the-yfstzh0zen5y) — IN the, United States
- [Partnership Director](https://feeny.ai/job/partnership-director-nabla-in-the-ta2havcb328m) — IN the, United States
- [Senior Application Security Engineer](https://feeny.ai/job/senior-application-security-engineer-apollo-io-united-states-pg5j0pgtv8hr) — United States