Hiring: Staff Security Engineer, GRC Company: Oscar Health Location: New York, NY Job Posted Time: 2026-09-12 11:04:42 Employment Type: Hybrid Target Skills & Keywords : AWS, Azure, Change Management, Configuration Management, FedRAMP, Infrastructure as Code, Risk Management, SIEM About the job Experience: •7+ years of combined experience in governance, risk, compliance, cloud security, security engineering, audit, or regulated technology environments. Required Skills: •Report into the CISO. •This position is based in our New York City office, requiring a hybrid work schedule with 3 days of in-office work per week. Thursdays are a required in-office day for team meetings and events, while your other two office days are flexible to suit your schedule. •The base pay for this role is: $245,916 - $286,902 per year You are also eligible for employee benefits, participation in Oscar's unlimited vacation program, company equity grants, and annual performance bonuses. •CMS EDE Governance: Lead governance and compliance strategy for CMS Enhanced Direct Enrollment platforms, with a focus on Phase 3 certification expectations, ongoing oversight, audit readiness, and regulator-facing evidence. •Control Architecture: Map CMS EDE and NIST SP 800-53 requirements to technical, operational, and administrative controls that can be implemented and measured across AWS and Azure environments. •Significant Change Management: Prepare, review, and submit CMS significant change requests, partner with technical teams on impact analysis, and maintain clear evidence of approval status, risk decisions, and implementation readiness. •Compliance as Code: Build and mature compliance-as-code patterns for AWS, including control automation, policy-as-code, infrastructure-as-code guardrails, continuous evidence collection, and automated drift detection. •POA&M Management: Own POA&M lifecycle management, including issue intake, risk rating, remediation planning, dependency tracking, stakeholder reporting, evidence validation, and closure readiness. Qualifications: •Deep working knowledge of CMS Enhanced Direct Enrollment requirements, including the ability to support or lead Phase 3 certification activities. •Strong knowledge of NIST SP 800-53 controls control expectations, including how those controls map to cloud-hosted healthcare platforms. •Hands-on experience partnering with engineering teams to implement controls in AWS using infrastructure as code, policy as code, automated evidence collection, or similar compliance automation approaches. •Demonstrated capacity to communicate regulatory and control requirements clearly to technical and non-technical audiences, including senior leaders and external assessors. •Bachelor's degree or years of equivalent experience. •Prior work experience in healthcare, health insurance, marketplace exchange, or other highly regulated technology environments. •Relevant security, audit, or cloud certifications such as CISSP, CISA, CRISC, CCSP, AWS Security Specialty, or equivalent practical experience. •This is an authentic Oscar Health job opportunity. Compensation: •$245,916 - $286,902 / year •Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving our members Interested candidates, please apply directly through the job posting on company's career page or try via AI auto apply on this platform. Don't miss this opportunity to join a forward-thinking team!