Security Specialist

Focus Financial Partners•St. Louis, MO

50d•$120,000 - $160,000•Hybrid

About The Position

The Security Specialist leads the execution and continuous improvement of the firm-wide cybersecurity awareness and training program across all Focus firms. The role is the primary owner for delivering engaging, effective, and risk-based cybersecurity training to employees at all levels, helping strengthen the firm’s security culture and reduce human-driven cyber risk. Reporting to the Head of Cybersecurity Governance, this individual-contributor role works closely with Legal, Privacy, Regulatory Compliance, HR, IT, and Security teams. The position is hybrid, with three days per week in the St. Louis office.

Requirements

5–8+ years of experience in cybersecurity awareness, training, GRC, or related security roles.
Hands-on experience delivering cybersecurity training programs in a regulated or complex environment.
Strong understanding of common cybersecurity risks, user behavior factors, and awareness best practices.
Experience partnering with Legal, Privacy, and Compliance teams on regulatory or audit-driven initiatives.
Excellent communication and content-development skills, including the ability to explain security concepts to non-technical audiences.
Highly organized and self-directed, with the ability to manage multiple initiatives across a distributed organization.

Nice To Haves

Experience in financial services or similarly regulated industries.
Familiarity with cybersecurity frameworks and regulatory requirements such as NIST CSF, NYDFS, and GLBA.
Experience with phishing simulation and training platforms.
Professional certifications such as CISSP, CISM, Security+, or relevant security awareness credentials.

Responsibilities

Execute the firm-wide cybersecurity awareness and training program across all Focus firms.
Deliver mandatory annual security training, role-based training, and targeted campaigns addressing risks such as phishing, social engineering, and data protection.
Manage phishing simulation programs, including campaign design, delivery, analysis, and follow-up education.
Coordinate training rollouts, schedules, and communications across business units.
Develop, maintain, and refresh cybersecurity training content for relevance, clarity, and engagement.
Tailor training materials for employees, advisors, leadership, and specialized roles.
Incorporate incident lessons, phishing results, regulatory feedback, and emerging threat trends into training content.
Balance regulatory requirements with practical, user-friendly training that supports business productivity.
Partner with Legal, Privacy, and Regulatory Compliance to align training with applicable laws, regulations, and contractual obligations.
Support regulatory examinations, audits, and client due diligence by providing training materials, metrics, and evidence.
Maintain documentation demonstrating compliance with cybersecurity training and awareness requirements.
Monitor regulatory expectations related to security awareness and adjust training accordingly.
Define and track training and awareness metrics, including completion rates, phishing susceptibility, and behavioral improvements.
Analyze trends and results to identify risk areas and inform targeted training initiatives.
Provide regular reporting and insights to the Head of Cybersecurity Governance and other stakeholders.
Demonstrate training program effectiveness in reducing human-driven cyber risk.
Collaborate with Cybersecurity Risk, Engineering, and Operations teams to align training with real-world threats and controls.
Coordinate with HR and Communications on onboarding, policy acknowledgment, and change-management initiatives.
Advise business teams on security awareness best practices.