Staff Security Engineer (GRC)
Confirmed on the employer's own hiring board on Nov 1, 2026. First seen by Alion on Sep 25, 2026.
Join Oscar Health as a Staff Security Engineer (GRC) and become a key player in ensuring the security and compliance of our healthcare technology environment. You will be responsible for translating regulatory requirements into practical control designs, compliance-as-code patterns, and risk management practices. You will work closely with engineering, security, legal, compliance, product, and CMS-facing stakeholders to keep regulated platforms audit-ready while enabling secure delivery.
Missions
- Lead governance and compliance strategy for CMS Enhanced Direct Enrollment platforms, focusing on Phase 3 certification expectations and audit readiness.
- Translate CMS EDE requirements, FedRAMP Moderate-aligned expectations, and NIST SP 800-53 controls into practical control designs and compliance-as-code patterns.
- Build and mature compliance-as-code patterns for AWS, including control automation, policy-as-code, infrastructure-as-code guardrails, and continuous evidence collection.
Profil recherché
- 7+ years of combined experience in governance, risk, compliance, cloud security, security engineering, audit, or regulated technology environments- Strong knowledge of NIST SP 800-53 controls control expectations, including how those controls map to cloud-hosted healthcare platforms
- Experience preparing CMS significant change requests, security impact analyses, POA&Ms, audit evidence, control narratives, risk acceptances, and remediation plans
- Hands-on experience partnering with engineering teams to implement controls in AWS using infrastructure as code, policy as code, automated evidence collection, or similar compliance automation approaches
- Deep working knowledge of CMS Enhanced Direct Enrollment requirements, including the ability to support or lead Phase 3 certification activities
- Ability to communicate regulatory and control requirements clearly to technical and non-technical audiences, including senior leaders and external assessors
- Relevant security, audit, or cloud certifications such as CISSP, CISA, CRISC, CCSP, AWS Security Specialty, or equivalent practical experience
- Experience with GRC platforms, cloud security posture management, SIEM/evidence pipelines, configuration management, or automated control monitoring
- Experience supporting CMS EDE Phase 3 certification, annual CMS audits, independent security assessments, or regulator-facing security reviews
- Prior work experience in healthcare, health insurance, marketplace exchange, or other highly regulated technology environments
- Bachelor's degree or years of equivalent experience