Oscar Health
Staff Security Engineer, GRC
$246K–$287K
New York, New York, United States · Staff · Full-time · Posted Aug 20, 2026
- Experience
- 7+ years of combined experience in governance, risk, compliance, cloud security, security engineering, audit, or regulated technology environments.
About the job
Leads GRC strategy and compliance engineering for Oscar’s CMS Enhanced Direct Enrollment platforms, keeping cloud-hosted systems audit-ready and supporting Phase 3 certification.
What you'll do
- Map CMS EDE and NIST SP 800-53 requirements to controls across AWS and Azure, and build AWS compliance-as-code and evidence workflows.
- Manage CMS significant change requests, POA&Ms, risk assessments, audit evidence, and remediation planning.
- Partner with engineering, security, product, legal, compliance, and external stakeholders on regulated platform security and compliance.
What they ask for
- Deep working knowledge of CMS Enhanced Direct Enrollment requirements and ability to support or lead Phase 3 certification.
- Strong knowledge of NIST SP 800-53 controls and their application to cloud-hosted healthcare platforms.
- Hands-on experience implementing AWS controls with infrastructure as code, policy as code, automated evidence collection, or similar compliance automation.
- Experience preparing CMS significant change requests, security impact analyses, POA&Ms, audit evidence, control narratives, risk acceptances, and remediation plans.
Nice to have
- Bachelor’s degree or years of equivalent experience.
- Experience in healthcare or other regulated technology environments; relevant security, audit, or cloud certifications are also noted as bonus points.
Pay
USD 245,916 - 286,902 per year base salary
Tools
AWS, Azure, NIST SP 800-53, infrastructure as code, policy as code
Model-written summary · the original posting is authoritative