Sr Security Policy Analyst

BJC HealthCare; Missouri; On-site; USD 90,000 - 120,000; Full time

Benefits offered by this job

Comprehensive benefits

401(k) plan with match

Tuition assistance

Job summary

BJC HealthCare is seeking a Senior Security Policy Analyst to maintain security policies and update applications in the GRC system. The role emphasizes strong writing skills, compliance knowledge, and meticulous attention to detail to safeguard information resources across the organization.

The position involves coordinating with Compliance and Legal, aligning policies with NIST CSF, NIST 800-53, HIPAA, HITECH, and PCI DSS, and guiding IT teams through policy revisions to enhance the

Qualifications

• Bachelor's degree required.
• 2-5 years of experience in security policy or governance.
• Experience with NIST CSF, NIST 800-53, HIPAA, HITECH, PCI DSS preferred.

Responsibilities

• Present policy changes to IT leadership and committees, administer the policy management solution and Governance, Risk and Compliance tool.
• Identify gaps and redundancies in the current policy structure and implement changes.
• Ensure mapping to NIST CSF, NIST 800-53, HIPAA, HITECH, PCI DSS for regulatory compliance.
• Lead project revisions to align policies with clinical and business objectives, risk management, and regulatory requirements.
• Collaborate with Compliance and Legal to incorporate policy provisions and advise IT security teams.

Skills

Excellent writing

Compliance knowledge

Attention to detail

Education

Bachelor's Degree

Tools

GRC system

Policy management tool

Job description

Additional Information About the Role

BJC is hiring for a Sr. Security Policy Analyst. We are looking for applicants in the St. Louis or Kansas City area. This role will be responsible for maintaining security policies and updating applications in the GRC system. The ideal candidate will have excellent writing skills, knowledge of compliance, and attention to detail.

Overview

BJC HealthCare is one of the largest nonprofit health care organizations in the United States, delivering services to residents primarily in the greater St. Louis, southern Illinois and southeast Missouri regions. With net revenues of $6.3billion and more than 30,000 employees, BJC serves patients and their families in urban, suburban and rural communities through its 14 hospitals and multiple community health locations. Services include inpatient and outpatient care, primary care, community health and wellness, workplace health, home health, community mental health, rehabilitation, long-term care and hospice.

BJC is the largest provider of charity care, unreimbursed care and community benefits in the state of Missouri. BJC and its hospitals and health service organizations provide $785.9 million annually in community benefit. That includes $410.6 million in charity care and other financial assistance to patients to ensure medical care regardless of their ability to pay. In addition, BJC provides additional community benefits through commitments to research, emergency preparedness, regional health care safety net services, health literacy, community outreach and community health programs and regional economic development.

BJC’s patients have access to the latest advances in medical science and technology through a formal affiliation between Barnes-Jewish Hospital and St. Louis Children’s Hospital with the renowned Washington University School of Medicine, which consistently ranks among the top medical schools in the country.

IS Security Services serves as an independent, objective catalyst for implementing effective and efficient controls to protect BJC HealthCare (BJC) information resources through collaboration with customers. We provide value to our customers and the organization by: Ensuring compliance with internal policies and external regulations; evaluating information system and application controls; educating BJC employees and other strategic partners on information systems security practices and concepts; acting as a resource on security controls for new and existing information systems and applications; recovering mission critical applications and data vital to the organization and strategic partners; investigating practices not in compliance with established BJC Information Services security policies and standards.

Preferred Qualifications

Role Purpose

Senior technology role responsible for understanding the requirements of the organization and the desired audience evaluating different publishing methods and options, and their costs, features and benefits — including open source and proprietary options developing and overseeing the implementation and maintenance of revisions (as needed) of a framework for content publishing, including preferred media, overall information structure, and rules for formatting content converting content into a format suitable for publication delivering content to the user at the point of need managing copyright, data protection and other legal issues associated with publishing and reusing published information and data ensuring published material is in a form accessible to all potential users, including those with disabilities releasing or retiring content.

Responsibilities

• Present proposed policy changes to Senior IT management, executive team members, Electronic Information Security Committee (EISC) and Information Security Operations Committee (ISOC) both in verbal and written form.Administer the policy management solution and support the Governance Risk and Compliance tool to include the following specific tasks:oUpdate and maintenance of existing policiesoProvisioning of policy administration accessoPeriodic validation policy administration accessoPolicy administration change management processes and monitoring
• Identify gaps and redundancies in the current IT policy structure and responsible for the implementation of needed changes in policies.
• Ensuring compliance of the mapping existing policies to the NIST Cybersecurity framework, NIST 800-53, and pertinent regulatory provisions (HIPAA, HITECH, PCI DSS) to ensure policies meet control best practice and regulatory requirements.
• Implements and maintains a project plan for revising and consolidating the existing policy structure to incorporate the following objectives: oPolicies align with strategic clinical and business objectives.oPolicies appropriately address organizational risks.oPolicies address regulatory requirements. oPolicies clearly define scope, responsibilities, service levels, security requirements, and relevant technology standards.
• Provides policy revision based on the monitored threats and regulatory environment. o Liaison to the BJC Compliance and Legal departments to incorporate required policy provisions into the existing policy structure.o Lead consultant to all IT Security teams to incorporate security and control requirements into the existing policy structure.

Minimum Requirements

Education

• Bachelor's Degree

Experience

• 2-5 years

Supervisor Experience

• No Experience

Preferred Requirements

Experience

• 5-10 years

Licenses & Certifications

• CIA
• CISA
• Cert Info Systems Manager
• CPA
• Certified in Risk & IS Control

Benefits and Legal Statement

BJC Total Rewards

At BJC we’re committed to providing you and your family with benefits and resources to help you manage your physical, emotional, social and financial well-being.

• Comprehensive medical, dental, vison, life insurance, and legal services available first day of the month after hire date
• Disability insurance* paid for by BJC
• Annual 4% BJC Automatic Retirement Contribution
• 401(k) plan with BJC match
• Tuition Assistance available on first day
• BJC Institute for Learning and Development
• Health Care and Dependent Care Flexible Spending Accounts
• Paid Time Off benefit combines vacation, sick days, holidays and personal time
• Adoption assistance

To learn more, go to our Benefits Summary.

*Not all benefits apply to all jobs

The above information on this description has been designed to indicate the general nature and level of work performed by employees in this position. It is not designed to contain or be interpreted as an exhaustive list of all responsibilities, duties and qualifications required of employees assigned to this job. Equal Opportunity Employer