Senior Security Engineer, Oscar Health

• 4+ years experience in Technology related field
• 4+ years experience in Security Engineering

Desirable

• The Principal GRC Engineer designs and operates the systems that enable continuous security assurance, deep risk visibility, and scalable regulatory compliance
• Rather than managing documentation or preparing for audits, this role engineers the infrastructure that allows the organization to demonstrate security and compliance continuously through automation, telemetry, and self-evidencing controls
• Operating at the intersection of security engineering, platform engineering, risk management, and regulatory assurance, you will embed governance and control validation directly into how systems are built and operated
• By connecting controls, operational telemetry, engineering workflows, and risk signals, you will surface patterns and relationships that traditional GRC programs cannot see, creating a feedback loop where security intelligence continuously informs engineering guardrails and platform architecture
• You will report into the Sr. Manager GRC
• Design systems that continuously measure and validate security controls through operational telemetry, automated evidence generation, and control health monitoring
• Build automation and orchestration across security tools, cloud platforms, and engineering systems to eliminate manual compliance processes and reduce audit overhead
• Translate governance expectations into machine-enforceable guardrails embedded within infrastructure platforms, CI/CD pipelines, and engineering workflows
• Apply automation, orchestration, and AI-assisted capabilities to scale governance workflows, enabling intelligent analysis and adaptive control systems
• Architect control and telemetry pipelines where operational systems produce the evidence required for regulatory assurance and audit readiness
• Compliance with all applicable laws and regulations
• Other duties as assigned