it's not the graph session take takes time to create.
it's probably the hibernate session factory that is created the first time around. the hibernate session is cached somewhere in the JbpmConfiguration. so you should not worry about that.
you should keep the JbpmConfiguration in a static field or in the webapp's application scope attributes somewhere.
the object is already cached in its lifespan: the jbpmContext.
whenever you get it a second time inside of the same jbpmContext, you'll get the same object from the cache.