Staff Security Engineer, GRC
Oscar Health · New York, New York, United States
Posted 27 days ago · $245,916 - $286,902
or apply directly on Oscar Health's site. We never take the application ourselves.
Is this posting real?
- This role has been open
- 27 days Oscar Health's roles stay open a median of 41 days
- Reposted
- No
- Salary listed
- Yes 90% of Oscar Health's roles list one
- Ghost-job risk at Oscar Health
- low 0 stale, 9 reposted of 303 open
- Hiring momentum
- 439 roles opened in the last 90 days ↑ up vs. the prior 90 days
- Last confirmed on the employer's board
- 2026-09-17
Measured from postings appearing on and disappearing from Oscar Health's own greenhouse board since 2026-08-03. Full hiring picture for Oscar Health.
About this role
As a Staff Security Engineer focusing on Governance, Risk, and Compliance (GRC), you will support Oscar's healthcare technology environment, particularly in relation to CMS Enhanced Direct Enrollment platforms. Your role involves translating regulatory requirements into practical control designs and compliance strategies, ensuring audit readiness, and collaborating with various stakeholders to maintain secure delivery of services.
- benefits
- 5/5
- freshness
- 4/5
- career value
- 4/5
- role clarity
- 5/5
- pay transparency
- 5/5
Scored from the posting itself — how clearly the role is described, how much it says about pay and benefits, and how recently it was listed. Not a judgement of Oscar Health as an employer.
What you need
- 7+ years of combined experience in governance, risk, compliance, cloud security, security engineering, audit, or regulated technology environments
- Deep working knowledge of CMS Enhanced Direct Enrollment requirements
- Strong knowledge of NIST SP 800-53 controls and their application to cloud-hosted healthcare platforms
- Hands-on experience with AWS using infrastructure as code and compliance automation
- Experience preparing CMS significant change requests, security impact analyses, and audit evidence
- Ability to communicate regulatory and control requirements clearly to technical and non-technical audiences
Nice to have
- Bachelor's degree or equivalent experience
- Prior work experience in healthcare or highly regulated technology environments
- Experience supporting CMS EDE Phase 3 certification and annual CMS audits
- Experience with GRC platforms, cloud security posture management, or automated control monitoring
- Relevant security, audit, or cloud certifications such as CISSP, CISA, or AWS Security Specialty
What you get
- Base pay of $245,916 - $286,902 per year
- Participation in Oscar's unlimited vacation program
- Company equity grants
- Annual performance bonuses
- Medical, dental, and vision benefits
- 11 paid holidays
Worth weighing
- Hybrid work schedule with 3 days in-office required
- Specific focus on CMS EDE platforms may limit exposure to broader security practices
- Role requires significant cross-functional collaboration, which may be challenging in a fast-paced environment
Summarised from Oscar Health's posting. Read the full original.
Listed by Oscar Health on their greenhouse job board, last confirmed open on 2026-09-17. PitchMeAI is not the employer.
More roles at Oscar Health
- Product Designer, ICHRASan Francisco, California, United States
- Associate Director, Corporate EventsNew York, New York, United States
- Senior Analyst, Payment Integrity DisputesRemote
- Product Designer, ICHRABoston, Massachusetts, United States
- VP, Clinical Strategy & IntegrationNew York, New York, United States
- Product Designer, ICHRANew York, New York, United States
- Product Designer, ICHRALos Angeles, California, United States
- Customer Service RepresentativeArizona, United States