HireMO

City/State: Saint Louis, Missouri

Categories: Information Services

Job Status: Full-Time

Req ID : 113927

Pay Range: $83,865.60 - $136,593.60 / year (Salary or hourly rate is based on job qualifications and relevant work experience)

Additional Information About the Role

BJC is hiring for a Sr. Security Policy Analyst. We are looking for applicants in the St. Louis or Kansas City area. The ideal applicant with a strong writing background, and willing to travel for Security Awareness events.

The Cybersecurity Policy Analyst supports the organization's security governance and human-risk management programs by developing clear, actionable cybersecurity policies and translating security requirements into effective workforce education. This blended role partners with Information Security, Compliance, Legal, Privacy, Human Resources, Communications, and business stakeholders to maintain policy documentation, promote secure behaviors, and strengthen a culture of cybersecurity awareness. The position also monitors regulatory, threat, and business changes to ensure policies and training remain current, relevant, measurable, and aligned with organizational risk.

Key Responsibilities

+ Policy governance: Draft, review, update, and maintain cybersecurity policies, standards, procedures, guidelines, and supporting documentation.

+ Requirements alignment: Map policy and awareness content to applicable laws, regulations, contractual obligations, and recognized cybersecurity frameworks.

+ Stakeholder coordination: Facilitate reviews, approvals, exception processes, publication, and periodic recertification with policy owners and subject-matter experts.

+ Exception management: Monitor, review, and approve cybersecurity policy exception requests in accordance with established governance processes and delegated approval authority.

+ Awareness and training: Design and deliver engaging cybersecurity education through annual training, role-based learning, microlearning, campaigns, presentations, newsletters, simulations, and events.

+ Content translation: Convert technical requirements, emerging threats, audit findings, and policy changes into clear guidance for technical and nontechnical audiences.

+ Program measurement: Track policy lifecycle status, training completion, simulation results, engagement, behavior indicators, and other metrics; identify trends and recommend improvements.

+ Risk and compliance support: Assist with audits, assessments, evidence collection, corrective action plans, and communications related to policy or awareness gaps.

+ Continuous improvement: Research evolving threats, regulatory expectations, industry practices, and learning methods to keep the program current and effective.

Overview

BJC HealthCare is one of the largest nonprofit health care organizations in the United States, delivering services to residents primarily in the greater St. Louis, southern Illinois and southeast Missouri regions. With net revenues of $6.3 billion and more than 30,000 employees, BJC serves patients and their families in urban, suburban and rural communities through its 14 hospitals and multiple community health locations. Services include inpatient and outpatient care, primary care, community health and wellness, workplace health, home health, community mental health, rehabilitation, long-term care and hospice.

BJC is the largest provider of charity care, unreimbursed care and community benefits in the state of Missouri. BJC and its hospitals and health service organizations provide $785.9 million annually in community benefit. That includes $410.6 million in charity care and other financial assistance to patients to ensure medical care regardless of their ability to pay. In addition, BJC provides additional community benefits through commitments to research, emergency preparedness, regional health care safety net services, health literacy, community outreach and community health programs and regional economic development.

BJC's patients have access to the latest advances in medical science and technology through a formal affiliation between Barnes-Jewish Hospital and St. Louis Children's Hospital with the renowned Washington University School of Medicine, which consistently ranks among the top medical schools in the country.

IS Security Services serves as an independent, objective catalyst for implementing effective and efficient controls to protect BJC HealthCare (BJC) information resources through collaboration with customers. We provide value to our customers and the organization by: Ensuring compliance with internal policies and external regulations; evaluating information system and application controls; educating BJC employees and other strategic partners on information systems security practices and concepts; acting as a resource on security controls for new and existing information systems and applications; recovering mission critical applications and data vital to the organization and strategic partners; investigating practices not in compliance with established BJC Information Services security policies and standards.

Preferred Qualifications

Role Purpose

Senior technology role responsible for understanding the requirements of the organization and the desired audience evaluating different publishing methods and options, and their costs, features and benefits - including open source and proprietary options developing and overseeing the implementation and maintenance of revisions (as needed) of a framework for content publishing, including preferred media, overall information structure, and rules for formatting content converting content into a format suitable for publication delivering content to the user at the point of need managing copyright, data protection and other legal issues associated with publishing and reusing published information and data ensuring published material is in a form accessible to all potential users, including those with disabilities releasing or retiring content.

Responsibilities

+ Present proposed policy changes to Senior IT management, executive team members, Electronic Information Security Committee (EISC) and Information Security Operations Committee (ISOC) both in verbal and written form.Administer the policy management solution and support the Governance Risk and Compliance tool to include the following specific tasks:oUpdate and maintenance of existing policiesoProvisioning of policy administration accessoPeriodic validation policy administration accessoPolicy administration change management processes and monitoring

+ Identify gaps and redundancies in the current IT policy structure and responsible for the implementation of needed changes in policies.

+ Ensuring compliance of the mapping existing policies to the NIST Cybersecurity framework, NIST 800-53, and pertinent regulatory provisions (HIPAA, HITECH, PCI DSS) to ensure policies meet control be...

Apply Externally

Jobs

Sr Security Policy Analyst

Summary

You Need a MO Jobs Account First

Jobs

Jobs

Sr Security Policy Analyst

Summary

Do You Have a MO Jobs Account?

First, Let's Find Your MO Jobs Account

Create an Account to Apply

You Need a MO Jobs Account First

HireMO Terms of Use

1. Acceptance and Changes

2. A No-Cost Public Workforce Service

3. Eligibility, Youth, and Authority

4. Accounts and Security

5. Accuracy Attestation and Program Information

6. Job Seeker Terms

7. Employer Terms

8. Assessments and Matching

9. Artificial Intelligence Features

10. Public Records and Required Notices

11. User Content and Permissions

12. Acceptable Use

13. Intellectual Property and Government Marks

14. Other Users and Third-Party Services

15. Electronic Communications

16. Suspension, Termination, and Records

17. Disclaimers

18. Limitation of Liability and Sovereign Immunity

19. Employer Indemnification

20. Governing Law and General Terms

21. Contact, Accessibility, and Complaints