# Staff Security Engineer, GRC at Oscar Health > Onsite · United States · Staff · Security · open. Source: https://alderhq.app/jobs/greenhouse%3Aoscar%3A8131843 (read 2026-11-13). ## Facts (observed) - Company: [Oscar Health](https://alderhq.app/companies/oscar-health) - Location text: New York, New York, United States; New York, NY - Where it can be done from (inferred): Onsite · United States (evidence: "Location: New York, New York, United States; New York, NY") - Posted: 2026-08-20 (85 days ago) - First seen by alder: 2026-11-02 · last verified: 2026-11-13 - Reposted: 0 times · edited: 0 times - Apply on the employer's site: https://job-boards.greenhouse.io/oscar/jobs/8131843 - Skills listed (inferred): AWS, Azure ## Pay and sponsorship - Posted pay: $246k–$287k per year (from the description) - Market band for similar posted roles (New York, n 31): p25 $211k, median $239k, p75 $264k - H-1B filings at this company for similar roles, FY26: 6, median offered wage $164k ([US DOL OFLC LCA disclosure data](https://www.dol.gov/agencies/eta/foreign-labor/performance)) ## Description (the employer's text) Hi, we're Oscar. We're hiring a Staff Security Engineer, GRC to join our Information Security Team. Oscar is the first health insurance company built around a full stack technology platform and a relentless focus on serving our members. We started Oscar in 2012 to create the kind of health insurance company we would want for ourselves—one that behaves like a doctor in the family. ### About the role As a Staff GRC Engineer, you will be a cloud-aware governance, risk, and compliance expert supporting Oscar's healthcare technology environment, with a specific focus on CMS Enhanced Direct Enrollment (EDE) platforms and stage 3 certification readiness. You will translate CMS EDE requirements, FedRAMP Moderate-aligned expectations, and NIST SP 800-53 controls into practical control designs, compliance-as-code patterns, evidence workflows, and risk management practices for AWS-hosted and Azure-hosted systems. You will operate as a senior subject matter expert who can partner directly with engineering, security, legal, compliance, product, and CMS-facing stakeholders to keep regulated platforms audit-ready while enabling secure delivery. You will report into the CISO. Work Location: This position is based in our New York City office, requiring a hybrid work schedule with 3 days of in-office work per week. Thursdays are a required in-office day for team meetings and events, while your other two office days are flexible to suit your schedule. #LI-Hybrid Pay Transparency: The base pay for this role is: $245,916 - $286,902 per year You are also eligible for employee benefits, participation in Oscar's unlimited vacation program, company equity grants, and annual performance bonuses. ### Responsibilities - CMS EDE Governance: Lead governance and compliance strategy for CMS Enhanced Direct Enrollment platforms, with a focus on Phase 3 certification expectations, ongoing oversight, audit readiness, and regulator-facing evidence. - Control Architecture: Map CMS EDE and NIST SP 800-53 requirements to technical, operational, and administrative controls that can be implemented and measured across AWS and Azure environments. - Significant Change Management: Prepare, review, and submit CMS significant change requests, partner with technical teams on impact analysis, and maintain clear evidence of approval status, risk decisions, and implementation readiness. - Compliance as Code: Build and mature compliance-as-code patterns for AWS, including control automation, policy-as-code, infrastructure-as-code guardrails, continuous evidence collection, and automated drift detection. - POA&M Management: Own POA&M lifecycle management, including issue intake, risk rating, remediation planning, dependency tracking, stakeholder reporting, evidence validation, and closure readiness. - Risk Assessment and Advisory: Perform risk assessments for cloud services, EDE platform changes, system integrations, third-party dependencies, and security exceptions using healthcare and federal control expectations. - Audit and Evidence Operations: Build repeatable evidence workflows for CMS audits, independent assessments, internal reviews, and customer or partner assurance requests. - Cross-Functional Leadership: Serve as a trusted GRC partner to engineering, security, product, compliance, legal, and business leaders, translating regulatory requirements into practical technical plans. - Compliance with all applicable laws and regulations - Other duties as assigned ### Requirements - 7+ years of combined experience in governance, risk, compliance, cloud security, security engineering, audit, or regulated technology environments. - Deep working knowledge of CMS Enhanced Direct Enrollment requirements, including the ability to support or lead Phase 3 certification activities. - Strong knowledge of NIST SP 800-53 controls control expectations, including how those controls map to cloud-hosted healthcare platforms. - Hands-on experience partnering with engineering teams to implement controls in AWS using infrastructure as code, policy as code, automated evidence collection, or similar compliance automation approaches. --- Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/greenhouse%3Aoscar%3A8131843 and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.