{"id":2009400,"url":"https://alion.io/job/oscar-health-staff-security-engineer-grc","title":"Staff Security Engineer (GRC)","company":{"id":3412,"name":"Oscar Health","domain":"hioscar.com","url":"https://alion.io/company/oscar-health","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Welcome to the Jungle","truth_index":null},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":245916,"max":286902,"currency":"USD","period":"year","gross":null,"usd_annual":286902},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"FedRAMP","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-09-25T00:13:35Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-11-03T04:06:39Z","board_verified":true,"closed_at":null,"days_open":39,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":39},"description":"Join Oscar Health as a Staff Security Engineer (GRC) and become a key player in ensuring the security and compliance of our healthcare technology environment. You will be responsible for translating regulatory requirements into practical control designs, compliance-as-code patterns, and risk management practices. You will work closely with engineering, security, legal, compliance, product, and CMS-facing stakeholders to keep regulated platforms audit-ready while enabling secure delivery.\nMissions\nLead governance and compliance strategy for CMS Enhanced Direct Enrollment platforms, focusing on Phase 3 certification expectations and audit readiness.\nTranslate CMS EDE requirements, FedRAMP Moderate-aligned expectations, and NIST SP 800-53 controls into practical control designs and compliance-as-code patterns.\nBuild and mature compliance-as-code patterns for AWS, including control automation, policy-as-code, infrastructure-as-code guardrails, and continuous evidence collection.\nProfil recherché\n - 7+ years of combined experience in governance, risk, compliance, cloud security, security engineering, audit, or regulated technology environments- Strong knowledge of NIST SP 800-53 controls control expectations, including how those controls map to cloud-hosted healthcare platforms\n- Experience preparing CMS significant change requests, security impact analyses, POA&Ms, audit evidence, control narratives, risk acceptances, and remediation plans\n- Hands-on experience partnering with engineering teams to implement controls in AWS using infrastructure as code, policy as code, automated evidence collection, or similar compliance automation approaches\n- Deep working knowledge of CMS Enhanced Direct Enrollment requirements, including the ability to support or lead Phase 3 certification activities\n- Ability to communicate regulatory and control requirements clearly to technical and non-technical audiences, including senior leaders and external assessors\n- Relevant security, audit, or cloud certifications such as CISSP, CISA, CRISC, CCSP, AWS Security Specialty, or equivalent practical experience\n- Experience with GRC platforms, cloud security posture management, SIEM/evidence pipelines, configuration management, or automated control monitoring\n- Experience supporting CMS EDE Phase 3 certification, annual CMS audits, independent security assessments, or regulator-facing security reviews\n- Prior work experience in healthcare, health insurance, marketplace exchange, or other highly regulated technology environments\n- Bachelor's degree or years of equivalent experience","description_format":"text","description_chars":2595,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Health insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Health Insurance & Benefits"],"lifecycle":[{"event":"open","at":"2026-10-07T12:59:06Z"}],"visa":[],"liveness":{"score":45,"band":"ok","label":"Likely open","p_open":1,"p_active":0.817,"p_room":0.55,"age_days":39,"expected_fill_days":28,"reasons":["conf:1","velocity","win:tail"],"computed_at":"2026-11-03T05:54:40Z"},"pay":{"stated_usd_annual":286902,"is_top_pay":true},"html_url":"https://alion.io/job/oscar-health-staff-security-engineer-grc","json_url":"https://alion.io/job/oscar-health-staff-security-engineer-grc.json","meta":{"generated_at":"2026-11-03T06:13:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8597,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3412},"rest":"https://alion.io/mcp/rest/get_company?id=3412"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Foscar-health-staff-security-engineer-grc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Foscar-health-staff-security-engineer-grc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Foscar-health-staff-security-engineer-grc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/oscar-health-staff-security-engineer-grc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Foscar-health-staff-security-engineer-grc"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2009400}},{"tool":"search_jobs","arguments":{"company":"hioscar.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2009400},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}