Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 84 days ago

Sr Security Policy Analyst

bjc1,244 open roles

Where
Saint Louis, Missouri, United States
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSr Security Policy Analystbjc · Saint Louis, Missouri, United States

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on bjc's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

11.5% of postings close within 7 days. Measured by our own scanner across the market. bjc postings stay open a median of 1 days.

Share of postings closed within
  1. 2.0%1 day
  2. 4.3%3 days
  3. 11.5%7 days
  4. 18.1%14 days
  5. 35.6%30 days
  6. 44.6%60 days
This job: posted 84 days ago

bjc median: 1 days open

The posting

Additional Information About the Role

BJC is hiring for a Sr. Security Policy Analyst. We are looking for applicants in the St. Louis or Kansas City area. The ideal applicant with a strong writing background, and willing to travel for Security Awareness events.

The Cybersecurity Policy Analyst supports the organization’s security governance and human-risk management programs by developing clear, actionable cybersecurity policies and translating security requirements into effective workforce education. This blended role partners with Information Security, Compliance, Legal, Privacy, Human Resources, Communications, and business stakeholders to maintain policy documentation, promote secure behaviors, and strengthen a culture of cybersecurity awareness. The position also monitors regulatory, threat, and business changes to ensure policies and training remain current, relevant, measurable, and aligned with organizational risk.

Key Responsibilities

  • Policy governance: Draft, review, update, and maintain cybersecurity policies, standards, procedures, guidelines, and supporting documentation.
  • Requirements alignment: Map policy and awareness content to applicable laws, regulations, contractual obligations, and recognized cybersecurity frameworks.
  • Stakeholder coordination: Facilitate reviews, approvals, exception processes, publication, and periodic recertification with policy owners and subject-matter experts.
  • Exception management: Monitor, review, and approve cybersecurity policy exception requests in accordance with established governance processes and delegated approval authority.
  • Awareness and training: Design and deliver engaging cybersecurity education through annual training, role-based learning, microlearning, campaigns, presentations, newsletters, simulations, and events.
  • Content translation: Convert technical requirements, emerging threats, audit findings, and policy changes into clear guidance for technical and nontechnical audiences.
  • Program measurement: Track policy lifecycle status, training completion, simulation results, engagement, behavior indicators, and other metrics; identify trends and recommend improvements.
  • Risk and compliance support: Assist with audits, assessments, evidence collection, corrective action plans, and communications related to policy or awareness gaps.
  • Continuous improvement: Research evolving threats, regulatory expectations, industry practices, and learning methods to keep the program current and effective.

Overview

BJC HealthCare is one of the largest nonprofit health care organizations in the United States, delivering services to residents primarily in the greater St. Louis, southern Illinois and southeast Missouri regions. With net revenues of $6.3 billion and more than 30,000 employees, BJC serves patients and their families in urban, suburban and rural communities through its 14 hospitals and multiple community health locations. Services include inpatient and outpatient care, primary care, community health and wellness, workplace health, home health, community mental health, rehabilitation, long-term care and hospice.

BJC is the largest provider of charity care, unreimbursed care and community benefits in the state of Missouri. BJC and its hospitals and health service organizations provide $785.9 million annually in community benefit. That includes $410.6 million in charity care and other financial assistance to patients to ensure medical care regardless of their ability to pay. In addition, BJC provides additional community benefits through commitments to research, emergency preparedness, regional health care safety net services, health literacy, community outreach and community health programs and regional economic development.

BJC’s patients have access to the latest advances in medical science and technology through a formal affiliation between Barnes-Jewish Hospital and St. Louis Children’s Hospital with the renowned Washington University School of Medicine, which consistently ranks among the top medical schools in the country.

IS Security Services serves as an independent, objective catalyst for implementing effective and efficient controls to protect BJC HealthCare (BJC) information resources through collaboration with customers. We provide value to our customers and the organization by: Ensuring compliance with internal policies and external regulations; evaluating information system and application controls; educating BJC employees and other strategic partners on information systems security practices and concepts; acting as a resource on security controls for new and existing information systems and applications; recovering mission critical applications and data vital to the organization and strategic partners; investigating practices not in compliance with established BJC Information Services security policies and standards.

Preferred Qualifications

Role Purpose

Senior technology role responsible for understanding the requirements of the organization and the desired audience evaluating different publishing methods and options, and their costs, features and benefits — including open source and proprietary options developing and overseeing the implementation and maintenance of revisions (as needed) of a framework for content publishing, including preferred media, overall information structure, and rules for formatting content converting content into a format suitable for publication delivering content to the user at the point of need managing copyright, data protection and other legal issues associated with publishing and reusing published information and data ensuring published material is in a form accessible to all potential users, including those with disabilities releasing or retiring content.

Responsibilities

Present proposed policy changes to Senior IT management, executive team members, Electronic Information Security Committee (EISC) and Information Security Operations Committee (ISOC) both in verbal and written form.Administer the policy management solution and support the Governance Risk and Compliance tool to include the following specific tasks:oUpdate and maintenance of existing policiesoProvisioning of policy administration accessoPeriodic validation policy administration accessoPolicy administration change management processes and monitoringIdentify gaps and redundancies in the current IT policy structure and responsible for the implementation of needed changes in policies.Ensuring compliance of the mapping existing policies to the NIST Cybersecurity framework, NIST 800-53, and pertinent regulatory provisions (HIPAA, HITECH, PCI DSS) to ensure policies meet control best practice and regulatory requirements.Implements and maintains a project plan for revising and consolidating the existing policy structure to incorporate the following objectives: oPolicies align with strategic clinical and business objectives.oPolicies appropriately address organizational risks.oPolicies address regulatory requirements. oPolicies clearly define scope, responsibilities, service levels, security requirements, and relevant technology standards.Provides policy revision based on the monitored threats and regulatory environment. o Liaison to the BJC Compliance and Legal departments to incorporate required policy provisions into the existing policy structure.o Lead consultant to all IT Security teams to incorporate security and control requirements into the existing policy structure.

Minimum Requirements

Education

Bachelor's Degree

Experience

2-5 years

Supervisor Experience

No Experience

Preferred Requirements

Experience

5-10 years

Licenses & Certifications

CIACISACert Info Systems ManagerCPACertified in Risk & IS Control Benefits and Legal Statement

BJC Total Rewards

At BJC we’re committed to providing you and your family with benefits and resources to help you manage your physical, emotional, social and financial well-being.

  • Comprehensive medical, dental, vison, life insurance, and legal services available first day of the month after hire date
  • Disability insurance* paid for by BJC
  • Annual 4% BJC Automatic Retirement Contribution
  • 401(k) plan with BJC match
  • Tuition Assistance available on first day
  • BJC Institute for Learning and Development
  • Health Care and Dependent Care Flexible Spending Accounts
  • Paid Time Off benefit combines vacation, sick days, holidays and personal time
  • Adoption assistance

To learn more, go to our Benefits Summary.

*Not all benefits apply to all jobs

The above information on this description has been designed to indicate the general nature and level of work performed by employees in this position. It is not designed to contain or be interpreted as an exhaustive list of all responsibilities, duties and qualifications required of employees assigned to this job. Equal Opportunity Employer

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against bjc's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on bjc's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    bjc's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.