Security Risk II Analyst

BJC HealthCare • Brentwood, MO

1d • Remote

About The Position

BJC HealthCare is one of the largest nonprofit health care organizations in the United States, delivering services to residents primarily in the greater St. Louis, southern Illinois and southeast Missouri regions. With net revenues of $6.3 billion and more than 30,000 employees, BJC serves patients and their families in urban, suburban and rural communities through its 14 hospitals and multiple community health locations. Services include inpatient and outpatient care, primary care, community health and wellness, workplace health, home health, community mental health, rehabilitation, long-term care and hospice.
BJC is the largest provider of charity care, unreimbursed care and community benefits in the state of Missouri. BJC and its hospitals and health service organizations provide $785.9 million annually in community benefit. That includes $410.6 million in charity care and other financial assistance to patients to ensure medical care regardless of their ability to pay. In addition, BJC provides additional community benefits through commitments to research, emergency preparedness, regional health care safety net services, health literacy, community outreach and community health programs and regional economic development.
BJC’s patients have access to the latest advances in medical science and technology through a formal affiliation between Barnes-Jewish Hospital and St. Louis Children’s Hospital with the renowned Washington University School of Medicine, which consistently ranks among the top medical schools in the country.
IS Security Services serves as an independent, objective catalyst for implementing effective and efficient controls to protect BJC HealthCare (BJC) information resources through collaboration with customers. We provide value to our customers and the organization by: Ensuring compliance with internal policies and external regulations; evaluating information system and application controls; educating BJC employees and other strategic partners on information systems security practices and concepts; acting as a resource on security controls for new and existing information systems and applications; recovering mission critical applications and data vital to the organization and strategic partners; investigating practices not in compliance with established BJC Information Services security policies and standards.

Requirements

• Bachelor's Degree
• 2-5 years experience
• No Supervisor Experience

Nice To Haves

• CIA
• CISA
• Cert Info Systems Manager
• CPA
• Certified in Risk & IS Control
• Experience in Security Risk Assessments and 3rd Party Risk Assessments.
• Experience with Logic 8 Platform is preferred.

Responsibilities

• Able to research, analyze, interpret, evaluate, and integrate complex data from a wide variety of sources and provide creative solutions that align with strategic clinical and business workflows. While ensuring compliance of system and application security within scope of responsibility, in accordance with defined service levels, security practices/guidelines, and relevant technology standards.
• Perform reviews of business solution self-assessments and assign risk rating. This includes performing a limited control review, completing documentation and presenting assessment in a formal review meeting.
• Perform timely vendor vetting assessments on potential business solutions based on business partner requests, highlighting security posture and control gaps and need mitigating activities. This includes but is not limited to conducting meetings with business process owners and vendors, investigating vendor security posture and performance, reviewing baseline controls and gaps, documenting results, and reporting findings in a formal report.
• Skillfully interact with business process owners, Technology and security personnel as well as vendors, management and other interested parties is required. This includes but is not limited to conducting meetings with business process owners and vendors, investigating vendor security posture and performance, reviewing baseline controls and gaps and documenting results while effectively report findings in a formal Security Risk Assessment report. Identify and complete Risk Acceptance forms where an exception to a policy or requirement is significant and needs to be reported to Management for approval.
• Responsible for adding and maintaining status updates for high and critical findings for high and critical business solutions on the Risk Register.

Benefits

• Comprehensive medical, dental, vison, life insurance, and legal services available first day of the month after hire date
• Disability insurance paid for by BJC
• Annual 4% BJC Automatic Retirement Contribution
• 401(k) plan with BJC match
• Tuition Assistance available on first day
• BJC Institute for Learning and Development
• Health Care and Dependent Care Flexible Spending Accounts
• Paid Time Off benefit combines vacation, sick days, holidays and personal time
• Adoption assistance

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Number of Employees: 251-500 employees