{"id":4218000,"url":"https://alion.io/job/icbc-senior-security-ops-analyst","title":"Senior Security Ops Analyst","company":{"id":1767742,"name":"ICBC","domain":"icbc.com","url":"https://alion.io/company/icbc-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Analytics","role_family":"Analytics","seniority":"senior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Vancouver, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Anomaly Detection","optional":false},{"name":"Bash","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"DNS","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SQL","optional":false},{"name":"Windows","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-11-10T00:00:00Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-13T03:30:41Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"We welcome applications from all qualified job seekers. Should you require any accommodations, including alternative interview formats, assistance with online assessments, or an ASL interpreter, throughout the application or hiring process, please email your request to  - we are committed to ensuring an accessible experience for all candidates.\nAt ICBC, we strive to build diverse teams which reflect the communities we serve. To support this, we’ve created two talent communities for Indigenous Peoples and People with Disabilities. By joining one of these communities, you’ll connect with our recruitment team who will guide you through the application process and help you explore opportunities at ICBC. Of course, you’re welcome to apply for jobs at ICBC whether or not you join a talent community.\nWe look forward to hearing from you!\nICBC is committed to delivering consistently high-quality customer service to all British Columbians. If you are dependable, collaborative, proactive, and committed to continuous learning, we welcome you to apply for this senior cybersecurity opportunity.\nReporting to the Manager of IT Security, the Senior SOC Analyst provides hands-on technical and operational leadership for cybersecurity detection, investigation, and response. The role leads day-to-day SOC operations, guides analysts during incidents, manages coverage and on-call schedules, and turns security roadmap initiatives into durable, measurable practices. The role also serves as a senior technical resource during complex investigations and security transformation initiatives.\nThis role requires technical credibility and disciplined delivery. The successful candidate will remain close to operational work, lead through complex incidents, proactively communicate risks and progress, and build trusted partnerships across business, technology, cloud, and service provider teams.\nYour responsibilities will include:\nLeading end-to-end triage, investigation, containment, eradication, recovery, escalation, and resolution of cybersecurity events and incidents, including coordination across internal teams, vendors, and managed-security partners when required.\nGuiding junior and intermediate analysts through incident triage, log analysis, case documentation, escalation decisions, and post-incident follow-up.\nManaging daily SOC operations, work prioritization, service quality, team schedules, operational coverage, weekend standby, and on-call rotations; escalating coverage or service risks early.\nProviding coaching, technical training, knowledge-transfer sessions, and timely feedback that strengthens analyst capability and team effectiveness.\nLeading SOC maturity initiatives involving Zero Trust Network Access (ZTNA), network detection and response (NDR), extended detection and response (XDR), Windows and Linux security, cloud-native application protection platforms (CNAPP), and exposure management, network access control (NAC), privileged access management (PAM), and device-trust capabilities.\nOwning assigned roadmap programs, including incident response, vulnerability and patch management, system hardening, configuration management, device trust, conditional access, exposure management, and resiliency planning, and security architecture improvement initiatives.\nApplying project management discipline to define outcomes, plans, milestones, dependencies, risks, measures, and reporting; following through commitments and delivering work on time.\nCreating practical initiatives to remove operational roadblocks, address recurring incidents and visibility gaps, reduce technical debt, and improve SOC processes and services.\nAnalyzing and correlating identity, email, endpoint, network, application, and cloud logs to determine attack paths, root cause, scope, business impact, and required remediation.\nImproving detection content, alert logic, automation, integrations, correlation, parsing, and tuning, and threat-hunting use cases to reduce false positives and strengthen response outcomes.\nPreparing accurate, concise, and timely updates for management that clearly communicate technical findings, operational impact, risk, decisions, progress, and next steps.\nWorking proactively with internal teams and service providers, recognizing their priorities and deadlines while providing practical security guidance that enables safe outcomes.\nThe successful candidate will have:\nSignificant hands-on experience in a SOC or comparable cybersecurity operations environment within a large, complex organization.\nDemonstrated technical leadership, including incident leadership, operational decision-making, mentoring, coaching, and guiding junior team members, and coordinating technical activities across multiple stakeholder groups.\nExperience managing SOC operations, work intake and prioritization, service performance, coverage planning, and on-call or standby schedules.\nExperience leading cybersecurity projects or maturity initiatives from planning through implementation, operationalization, measurement, and continuous improvement, and transition into ongoing operations.\nA proven record of ownership, dependable follow-through, on-time delivery, proactive risk escalation, and clear management of communication.\nDemonstrated passion for cybersecurity and self-initiated learning through current research, hands-on labs, formal training, certifications, or cybersecurity-community participation.\nThe candidate will bring demonstrated knowledge, skills, and practical experience in:\nZTNA and Zero Trust principles, including identity and device trust, conditional access, least privilege, segmentation, and continuous verification, network access control (NAC), and privileged access management (PAM).\nNDR and network-security monitoring, including network protocols, the OSI model, DNS, web, email, remote access, and encrypted-traffic analysis, network segmentation, traffic-flow analysis, and anomaly detection.\nXDR and endpoint investigation across Windows and Linux, including host telemetry, identity activity, persistence, malicious behavior, and containment actions.\nSIEM, SOAR, UEBA, EDR/XDR, NDR, CNAPP, vulnerability management, exposure management, email security, and network-monitoring technologies.\nCloud and CNAPP capabilities, including workload protection, cloud-security posture, identity and entitlement risk, and cloud-native threat detection.\nEmail architecture and flow, including SMTP, DNS, mail gateways, message headers, SPF, DKIM, DMARC, phishing, spoofing, and business email compromise.\nLog and telemetry analysis across identity, endpoint, network, email, application, and cloud sources to identify root cause, affected assets, attack paths, and remediation.\nIncident response, vulnerability and patch management, system hardening, configuration management, exposure management, and operational resiliency.\nMITRE ATT&CK, Cyber Kill Chain, NIST Cybersecurity Framework, CIS Controls, and ISO/IEC 27000-series controls.\nClear written and verbal communication, including management briefings, project and operational updates, incident reporting, coaching conversations, and cross-team coordination.\nKQL, Python, PowerShell, Bash, or SQL would be an asset. Relevant certifications such as GCIH, GCIA, GCFA, CISSP, Security+, or SC-200, CISM, CRISC, AZ-500, or comparable security-focused certifications would also be an asset.\nLeadership approach:\nWe are looking for a collaborative, service-oriented leader who combines hands-on technical credibility with sound judgment, accountability, empathy, and proactive communication. The successful candidate will treat other teams as partners, set clear expectations, develop people through coaching and training, and create an environment of ownership and continuous improvement. This role is well suited to someone with an initial foundation in technical leadership who is ready for substantially more responsibility and continued growth.\nAbout us\nAt ICBC, it’s our job to make sure the car insurance system works for everyone in British Columbia, today and in the future. If you want to make the most of your skills and expertise while growing your career, we want you. A career at ICBC is an opportunity to be part of a talented, diverse and inclusive team that is driven to serve its customers and community. You can expect a competitive salary, comprehensive benefits and a collaborative work environment. If you are reliable and dependable, apply today to be part of our talented and diverse team as we work together to create an insurance system we can all be proud of.\nWork arrangements defined\nHybrid 8 - you will work a minimum of 2 days per week at your primary in-office headquarters, subject to operational requirements. The remaining days will be remote within British Columbia. \nICBC Head Office Relocation\nThis role is currently based at our Head Office in North Vancouver. In Spring/Summer 2027, the role will relocate to our new Head Office at 2150 Keith Drive in Vancouver, conveniently located next to VCC-Clark SkyTrain Station on the Millennium Line.\nBenefits\nICBC provides comprehensive benefit coverage to all eligible permanent full time bargaining unit employees including a defined benefit pension plan and 3 weeks’ vacation, plus up to 16 days of time off.\nExtended Health and dental coverage (no premiums)\nEmployee and Family assistance program (wellness support)\nBasic group life insurance\nVoluntary group life insurance\nCritical Illness insurance\nSick leave plan - 100% of pay for a period of a maximum of 150 hours\nLong term disability plan\nPension plan - defined benefit pension plan that pays a benefit to you or your beneficiary upon termination, death, or retirement.\nBenefits for part-time employees may be pro-rated, with benefit costs shared between ICBC and the employee.\nBU benefits are determined by the collective agreement and may change from time to time based on collective bargaining negotiations.\nOnly candidates legally entitled to work in Canada will be considered for this position.","description_format":"text","description_chars":10072,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Life insurance"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":true,"industries":["Network Security","Property & Casualty Insurance"],"lifecycle":[{"event":"open","at":"2026-11-13T03:30:41Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":3,"expected_fill_days":30,"reasons":["conf:1","win:early"],"computed_at":"2026-11-13T05:04:01Z"},"pay":null,"html_url":"https://alion.io/job/icbc-senior-security-ops-analyst","json_url":"https://alion.io/job/icbc-senior-security-ops-analyst.json","meta":{"generated_at":"2026-11-13T05:04:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10711,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1767742},"rest":"https://alion.io/mcp/rest/get_company?id=1767742"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ficbc-senior-security-ops-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ficbc-senior-security-ops-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ficbc-senior-security-ops-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/icbc-senior-security-ops-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ficbc-senior-security-ops-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4218000}},{"tool":"search_jobs","arguments":{"company":"icbc.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4218000},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}