Description
Hi, we're Oscar. We're hiring a Staff Security Engineer, GRC to join our Information Security Team.
Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving our members. We started Oscar in 2012 to create the kind of health insurance company we would want for ourselves—one that behaves like a doctor in the family.
About the role:
As a Staff GRC Engineer, you will be a cloud-aware governance, risk, and compliance expert supporting Oscar's healthcare technology environment, with a specific focus on CMS Enhanced Direct Enrollment (EDE) platforms and stage 3 certification readiness. You will translate CMS EDE requirements, FedRAMP Moderate-aligned expectations, and NIST SP 800-53 controls into practical control designs, compliance-as-code patterns, evidence workflows, and risk management practices for AWS-hosted and Azure-hosted systems. You will operate as a senior subject matter expert who can partner directly with engineering, security, legal, compliance, product, and CMS-facing stakeholders to keep regulated platforms audit-ready while enabling secure delivery.
You will report into the CISO.
Work Location: This position is based in our New York City office, requiring a hybrid work schedule with 3 days of in-office work per week. Thursdays are a required in-office day for team meetings and events, while your other two office days are flexible to suit your schedule. #LI-Hybrid
Pay Transparency: The base pay for this role is: $245,916 - $286,902 per year You are also eligible for employee benefits, participation in Oscar's unlimited vacation program, company equity grants, and annual performance bonuses.
Responsibilities:
- CMS EDE Governance: Lead governance and compliance strategy for CMS Enhanced Direct Enrollment platforms, with a focus on Phase 3 certification expectations, ongoing oversight, audit readiness, and regulator-facing evidence.
- Control Architecture: Map CMS EDE and NIST SP 800-53 requirements to technical, operational, and administrative controls that can be implemented and measured across AWS and Azure environments.
- Significant Change Management: Prepare, review, and submit CMS significant change requests, partner with technical teams on impact analysis, and maintain clear evidence of approval status, risk decisions, and implementation readiness.
- Compliance as Code: Build and mature compliance-as-code patterns for AWS, including control automation, policy-as-code, infrastructure-as-code guardrails, continuous evidence collection, and automated drift detection.
- POA&M Management: Own POA&M lifecycle management, including issue intake, risk rating, remediation planning, dependency tracking, stakeholder reporting, evidence validation, and closure readiness.
- Risk Assessment and Advisory: Perform risk assessments for cloud services, EDE platform changes, system integrations, third-party dependencies, and security exceptions using healthcare and federal control expectations.
- Audit and Evidence Operations: Build repeatable evidence workflows for CMS audits, independent assessments, internal reviews, and customer or partner assurance requests.
- Cross-Functional Leadership: Serve as a trusted GRC partner to engineering, security, product, compliance, legal, and business leaders, translating regulatory requirements into practical technical plans.
- Compliance with all applicable laws and regulations
- Other duties as assigned
Requirements:
- 7+ years of combined experience in governance, risk, compliance, cloud security, security engineering, audit, or regulated technology environments.
- Deep working knowledge of CMS Enhanced Direct Enrollment requirements, including the ability to support or lead Phase 3 certification activities.
- Strong knowledge of NIST SP 800-53 controls control expectations, including how those controls map to cloud-hosted healthcare platforms.
- Hands-on experience partnering with engineering teams to implement controls in AWS using infrastructure as code, policy as code, automated evidence collection, or similar compliance automation approaches.
- Experience preparing CMS significant change requests, security impact analyses, POA&Ms, audit evidence, control narratives, risk acceptances, and remediation plans.
- Ability to communicate regulatory and control requirements clearly to technical and non-technical audiences, including senior leaders and external assessors.
Bonus points:
- Bachelor's degree or years of equivalent experience.
- Prior work experience in healthcare, health insurance, marketplace exchange, or other highly regulated technology environments.
- Experience supporting CMS EDE Phase 3 certification, annual CMS audits, independent security assessments, or regulator-facing security reviews.
- Experience with GRC platforms, cloud security posture management, SIEM/evidence pipelines, configuration management, or automated control monitoring.
- Relevant security, audit, or cloud certifications such as CISSP, CISA, CRISC, CCSP, AWS Security Specialty, or equivalent practical experience.
This is an authentic Oscar Health job opportunity. Learn more about how you can safeguard yourself from recruitment fraud here.
At Oscar, being an Equal Opportunity Employer means more than upholding discrimination-free hiring practices. It means that we cultivate an environment where people can be their most authentic selves and find both belonging and support. We're on a mission to change health care -- an experience made whole by our unique backgrounds and perspectives.
Pay Transparency: Final offer amounts, within the base pay set forth above, are determined by factors including your relevant skills, education, and experience. Full-time employees are eligible for benefits including: medical, dental, and vision benefits, 11 paid holidays, paid sick time, paid parental leave, 401(k) plan participation, life and disability insurance, and paid wellness time and reimbursements.
Artificial Intelligence (AI): Our AI Guidelines outline the acceptable use of artificial intelligence for candidates and detail how we use AI to support our recruiting efforts.
Reasonable Accommodation: Oscar applicants are considered solely based on their qualifications, without regard to applicant’s disability or need for accommodation. Any Oscar applicant who requires reasonable accommodations during the application process should contact the Oscar Benefits Team (accommodations@hioscar.com) to make the need for an accommodation known.
California Residents: For information about our collection, use, and disclosure of applicants’ personal information as well as applicants’ rights over their personal information, please see our Privacy Policy.
Similar jobs
Est. 208,708 USD
Hi, we're Oscar. We're hiring a Senior Software Engineer, Cloud Infrastructure / SRE to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a relentles…
Est. 189,560 USD
Hi, we're Oscar. We're hiring a Senior Identity and Access Manager to join our Security Team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving ou…
Est. 208,708 USD
Hi, we're Oscar. We're hiring a Senior Software Engineer, Cloud Infrastructure / SRE to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a relentles…
Est. 189,560 USD
Hi, we're Oscar. We're hiring a Senior Product Security Engineer 1 to join our Security Team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving ou…
Est. 208,708 USD
Hi, we're Oscar. We're hiring a Senior Software Engineer, Cloud Infrastructure / SRE to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a relentles…
Est. 208,708 USD
Hi, we're Oscar. We're hiring a Senior Software Engineer, Cloud Infrastructure / SRE to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a relentles…
Est. 208,708 USD
Hi, we're Oscar. We're hiring a Senior Software Engineer, Cloud Infrastructure / SRE to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a relentles…
Est. 222,000 USD
Hi, we're Oscar. We're hiring Staff Software Engineers to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a focus on serving our members. We starte…
Est. 87,021 USD
Hi, we're Oscar. We're hiring a Senior Specialist, Process Improvement to join our Authorization Services Process Improvement team. Oscar is the first health insurance company built around a full stack technology platfor…
Est. 183,150 USD
Hi, we're Oscar. We're hiring a Senior Software Engineer, Backend to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a focus on serving our members…
Est. 189,560 USD
Hi, we're Oscar. We're hiring a Senior Software Engineer, Fullstack to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a focus on serving our membe…
Est. 87,021 USD
Hi, we're Oscar. We're hiring a Senior Specialist, Issue Management to join our Network Operations team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on…
Est. 167,828 USD
Hi, we're Oscar. We're hiring a Senior Manager, Insurance Growth Strategic Implementation to join our Strategic Implementation Team. Oscar is the first health insurance company built around a full stack technology platfo…
Est. 189,560 USD
Hi, we're Oscar. We're hiring a Senior Security AI Engineer 1 to join our Security Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on ser…
Est. 222,000 USD
Hi, we're Oscar. We're hiring Staff Software Engineers to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a focus on serving our members. We starte…
Est. 172,328 USD
Hi, we're Oscar. We're hiring an Associate Director, Corporate Compliance to join our Corporate Compliance team. Oscar is the first health insurance company built around a full stack technology platform and a relentless…
Est. 78,352 USD
Hi, we're Oscar. We're hiring a Analyst, Regulatory Affairs to join our Regulatory Affairs team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving…
Est. 189,560 USD
Hi, we're Oscar. We're hiring an Engineering Manager to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a focus on serving our members. We started…
Est. 183,150 USD
Hi, we're Oscar. We're hiring a Senior Software Engineer, Backend to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a focus on serving our members…
Est. 157,009 USD
Hi, we're Oscar. We're hiring a Senior Manager, People Compliance to join our People team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving our m…
Est. 142,649 USD
Hi, we're Oscar. We're hiring a Manager, Portfolio Execution to join our Project Management Team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on servin…
Est. 252,747 USD
Hi, we're Oscar. We're hiring a Senior Director to join our Provider Experience team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving our member…
Est. 111,150 USD
Hi, we're Oscar. We're hiring a Manager, Regulatory Reporting to join our Compliance team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving our m…
Est. 135,947 USD
Hi, we're Oscar. We're hiring a Technical Program Manager, Infra to join our Tech Strategy & Ops team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus…
Est. 111,150 USD
Hi, we're Oscar. We're hiring a Manager, Regulatory Reporting to join our Compliance team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving our m…
Est. 78,309 USD
Hi, we're Oscar. We're hiring a Senior Specialist, Issue Management to join our Network Operations team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on…
Est. 78,309 USD
Hi, we're Oscar. We're hiring a Senior Specialist, Process Improvement to join our Authorization Services Process Improvement team. About the role: You will work with business and technical Oscar team members and represe…
Est. 222,000 USD
Hi, we're Oscar. We're hiring Staff Software Engineers to join our Engineering team. Oscar is the first health insurance company built around a full stack technology platform and a focus on serving our members. We starte…
Est. 59,360 USD
Hi, we're Oscar. We're hiring a Analyst, Regulatory Affairs to join our Regulatory Affairs team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving…
Est. 112,012 USD
Hi, we're Oscar. We're hiring an Associate, Process Optimization to join our Eligibility and Billing team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus…