Senior Product Security Engineer I

Oscar Health•New York, NY

7h•$163,944 - $215,176•Hybrid

About The Position

Oscar is hiring a Senior Product Security Engineer to join its Security Team. The role is a key technical resource for securing the software development life cycle (SDLC), from design through completion, at the intersection of application security and AI-driven engineering. The engineer will help keep development workflows fast and secure, architect and build application security systems and processes, and design security measures for AI-driven workflows, including integrating security reviews into AI agent processes that bypass traditional ticketing. The position reports to the Manager of Product Security and is based in Oscar’s New York City office, with a hybrid schedule requiring three in-office days per week. Thursdays are required in the office; the other two office days are flexible. The base salary is $163,944–$215,176 per year. The role is also eligible for employee benefits, Oscar’s unlimited vacation program, company equity grants, and annual performance bonuses. Oscar describes itself as an Equal Opportunity Employer committed to an inclusive environment where people can be their authentic selves.

Requirements

At least 4 years of combined career experience in software development and information security.
Proven experience across all areas of the Secure Software Development Life Cycle.
Strong background building moderately complex to complex standalone systems or major new features.
Hands-on experience using AI models and integrating them with internal systems through protocols such as the Model Context Protocol (MCP).

Nice To Haves

Bachelor’s degree or four years of equivalent experience.
Prior work experience in, or understanding of, security challenges specific to healthcare or health insurance.

Responsibilities

Drive vulnerability management from automated identification using SAST/DAST through manual analysis and remediation tracking.
Serve as a technical resource and mentor to junior engineers, providing guidance and helping develop effective workflows.
Conduct source code reviews of internal and third-party software.
Write production-quality code and libraries for engineering teams to use.
Build risk assessment frameworks and create action plans for managing assessed risks.
Translate complex security concerns into actionable steps.
Guide Engineering teams in remediating or migrating vulnerabilities.
Deliver in-depth software security presentations to the engineering team.
Comply with all laws and regulations.
Perform other duties as assigned.