Oscar Health: Staff Security Engineer, GRC — New York, New York, United States

About Oscar Health

Oscar Health is a health-insurance business built around a technology platform and member services. Its recruitment board also describes Oscar Medical Group activities in virtual health assessments and virtual care. Those notices reflect distinct parts of the wider operation: insurance products and member administration alongside clinical services. Technology, insurance operations and care delivery consequently appear in different roles on the board, with the employing team determining the service and professional responsibilities of an individual position.

The position and its setting

Oscar Health lists Staff Security Engineer, GRC in New York, New York, United States, under reference 8131843. The details below separate the work described by the employer from essential conditions, preferred experience and practical preparation advice.

• Department: Security
• Employer listing date: 20 August 2026

Responsibilities and work described

• As a Staff GRC Engineer, you will be a cloud-aware governance, risk, and compliance expert supporting Oscar's healthcare technology environment, with a specific focus on CMS Enhanced Direct Enrollment (EDE) platforms and stage 3 certification readiness
• Translate CMS EDE requirements, FedRAMP Moderate-aligned expectations, and NIST SP 800-53 controls into practical control designs, compliance-as-code patterns, evidence workflows, and risk management practices for AWS-hosted and Azure-hosted systems
• Operate as a senior subject matter expert who can partner directly with engineering, security, legal, compliance, product, and CMS-facing stakeholders to keep regulated platforms audit-ready while enabling secure delivery
• Report into the CISO
• Work: Location: This position is based in our New York City office, requiring a hybrid work schedule with 3 days of in-office work per week
• Thursdays are a required in-office day for team meetings and events, while your other two office days are flexible to suit your schedule. #LI-Hybrid
• Pay Transparency: The base pay for this role is: $245,916 - $286,902 per year You are also eligible for employee benefits, participation in Oscar's unlimited vacation program, company equity grants, and annual performance bonuses
• CMS EDE Governance: Lead governance and compliance strategy for CMS Enhanced Direct Enrollment platforms, with a focus on Phase 3 certification expectations, ongoing oversight, audit readiness, and regulator-facing evidence
• Control Architecture: Map CMS EDE and NIST SP 800-53 requirements to technical, operational, and administrative controls that can be implemented and measured across AWS and Azure environments
• Significant Change Management: Prepare, review, and submit CMS significant change requests, partner with technical teams on impact analysis, and maintain clear evidence of approval status, risk decisions, and implementation readiness
• Compliance as Code: Build and mature compliance-as-code patterns for AWS, including control automation, policy-as-code, infrastructure-as-code guardrails, continuous evidence collection, and automated drift detection
• POA&M Management: Own POA&M lifecycle management, including issue intake, risk rating, remediation planning, dependency tracking, stakeholder reporting, evidence validation, and closure readiness
• Risk Assessment and Advisory: Perform risk assessments for cloud services, EDE platform changes, system integrations, third-party dependencies, and security exceptions using healthcare and federal control expectations
• Audit and Evidence Operations: Build repeatable evidence workflows for CMS audits, independent assessments, internal reviews, and customer or partner assurance requests
• Cross-Functional Leadership: Serve as a trusted GRC partner to engineering, security, product, compliance, legal, and business leaders, translating regulatory requirements into practical technical plans
• Compliance with all applicable laws and regulations

Essential requirements and candidate background

• 7+ years of combined experience in governance, risk, compliance, cloud security, security engineering, audit, or regulated technology environments
• Deep working knowledge of CMS Enhanced Direct Enrollment requirements, including the ability to support or lead Phase 3 certification activities
• Knowledge: NIST SP 800-53 controls control expectations, including how those controls map to cloud-hosted healthcare platforms
• Hands-on experience partnering with engineering teams to implement controls in AWS using infrastructure as code, policy as code, automated evidence collection, or similar compliance automation approaches
• Experience preparing CMS significant change requests, security impact analyses, POA&Ms, audit evidence, control narratives, risk acceptances, and remediation plans
• Communicate regulatory and control requirements clearly to technical and non-technical audiences, including senior leaders and external assessors

Education and qualification routes

• Degree / qualification: Bachelor's degree or years of equivalent experience

Preferred experience and additional strengths

• Prior work experience in healthcare, health insurance, marketplace exchange, or other highly regulated technology environments
• Experience supporting CMS EDE Phase 3 certification, annual CMS audits, independent security assessments, or regulator-facing security reviews
• Experience: GRC platforms, cloud security posture management, SIEM/evidence pipelines, configuration management, or automated control monitoring
• Relevant security, audit, or cloud certifications such as CISSP, CISA, CRISC, CCSP, AWS Security Specialty, or equivalent practical experience
• This is an authentic Oscar Health job opportunity
• Pay Transparency: Final offer amounts, within the base pay set forth above, are determined by factors including your relevant skills, education, and experience
• Full-time employees are eligible for benefits including: medical, dental, and vision benefits, 11 paid holidays, paid sick time, paid parental leave, 401(k) plan participation, life and disability insurance, and paid wellness time and reimbursements
• Artificial Intelligence (AI): Our AI Guidelines outline the acceptable use of artificial intelligence for candidates and detail how we use AI to support our recruiting efforts
• California Residents: For information about our collection, use, and disclosure of applicants’ personal information as well as applicants’ rights over their personal information, please see our Privacy Policy

Location, schedule and contract conditions

For this overseas or regional listing, confirm work authorisation and any location restrictions with the employer. The location does not establish visa sponsorship or permission to work remotely from India.

• Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving our members
• We started Oscar in 2012 to create the kind of health insurance company we would want for ourselves—one that behaves like a doctor in the family
• Advertised location: New York, New York, United States

Pay and application dates

A verified salary figure is not established in this article. An online estimate for another Staff Security Engineer, GRC vacancy is not an offer for reference 8131843; use the employer’s own pay disclosure and recruitment communication.

A closing date is not confirmed in this article. Check the current employer page before submitting: an undated posting can change or be withdrawn.

How to apply to Oscar Health

Applications follow the official employer page linked below.

Open the official Oscar Health posting below and match the title and reference 8131843.

Compare your qualifications and experience with the essential conditions for the New York, New York, United States position, then read the preferred criteria separately.

Prepare an accurate CV and the supporting items requested in that employer’s application. Provide only information and documents you are authorised to share.

Use the employer’s application option, complete the required fields and review the submission. Retain the acknowledgement when one is provided. Job Alerts World does not receive the application.

Practical preparation: AWS

For AWS experience, describe the workload and the services you actually configured or operated. Useful detail includes deployment, access controls, monitoring, recovery or cost decisions where those were your responsibility.

Relevant skills

• AWS
• Azure
• AI/ML
• AI
• audit
• risk management
• compliance
• insurance
• stakeholder management