Senior Security Ops Analyst

We welcome applications from all qualified job seekers. Should you require any accommodations, including alternative interview formats, assistance with online assessments, or an ASL interpreter, throughout the application or hiring process, please email your request to [email protected] – we are committed to ensuring an accessible experience for all candidates.

At ICBC, we strive to build diverse teams which reflect the communities we serve. To support this, we’ve created two talent communities for Indigenous Peoples and People with Disabilities. By joining one of these communities, you’ll connect with our recruitment team who will guide you through the application process and help you explore opportunities at ICBC. Of course, you’re welcome to apply for jobs at ICBC whether or not you join a talent community.

We look forward to hearing from you!

ICBC is committed to delivering consistently high-quality customer service to all British Columbians. If you are dependable, collaborative, proactive, and committed to continuous learning, we welcome you to apply for this senior cybersecurity opportunity.

Reporting to the Manager of IT Security, the Senior SOC Analyst provides hands-on technical and operational leadership for cybersecurity detection, investigation, and response. The role leads day-to-day SOC operations, guides analysts during incidents, manages coverage and on-call schedules, and turns security roadmap initiatives into durable, measurable practices. The role also serves as a senior technical resource during complex investigations and security transformation initiatives.

This role requires technical credibility and disciplined delivery. The successful candidate will remain close to operational work, lead through complex incidents, proactively communicate risks and progress, and build trusted partnerships across business, technology, cloud, and service provider teams.

Your responsibilities will include:
• Leading end-to-end triage, investigation, containment, eradication, recovery, escalation, and resolution of cybersecurity events and incidents, including coordination across internal teams, vendors, and managed-security partners when required.
• Guiding junior and intermediate analysts through incident triage, log analysis, case documentation, escalation decisions, and post-incident follow-up.
• Managing daily SOC operations, work prioritization, service quality, team schedules, operational coverage, weekend standby, and on-call rotations; escalating coverage or service risks early.
• Providing coaching, technical training, knowledge-transfer sessions, and timely feedback that strengthens analyst capability and team effectiveness.
• Leading SOC maturity initiatives involving Zero Trust Network Access (ZTNA), network detection and response (NDR), extended detection and response (XDR), Windows and Linux security, cloud-native application protection platforms (CNAPP), and exposure management, network access control (NAC), privileged access management (PAM), and device-trust capabilities.
• Owning assigned roadmap programs, including incident response, vulnerability and patch management, system hardening, configuration management, device trust, conditional access, exposure management, and resiliency planning, and security architecture improvement initiatives.
• Applying project management discipline to define outcomes, plans, milestones, dependencies, risks, measures, and reporting; following through commitments and delivering work on time.
• Creating practical initiatives to remove operational roadblocks, address recurring incidents and visibility gaps, reduce technical debt, and improve SOC processes and services.
• Analyzing and correlating identity, email, endpoint, network, application, and cloud logs to determine attack paths, root cause, scope, business impact, and required remediation.
• Improving detection content, alert logic, automation, integrations, correlation, parsing, and tuning, and threat-hunting use cases to reduce false positives and strengthen response outcomes.
• Preparing accurate, concise, and timely updates for management that clearly communicate technical findings, operational impact, risk, decisions, progress, and next steps.
• Working proactively with internal teams and service providers, recognizing their priorities and deadlines while providing practical security guidance that enables safe outcomes.

The successful candidate will have:
• Significant hands-on experience in a SOC or comparable cybersecurity operations environment within a large, complex organization.
• Demonstrated technical leadership, including incident leadership, operational decision-making, mentoring, coaching, and guiding junior team members, and coordinating technical activities across multiple stakeholder groups.
• Experience managing SOC operations, work intake and prioritization, service performance, coverage planning, and on-call or standby schedules.
• Experience leading cybersecurity projects or maturity initiatives from planning through implementation, operationalization, measurement, and continuous improvement, and transition into ongoing operations.
• A proven record of ownership, dependable follow-through, on-time delivery, proactive risk escalation, and clear management of communication.
• Demonstrated passion for cybersecurity and self-initiated learning through current research, hands-on labs, formal training, certifications, or cybersecurity-community participation.
The candidate will bring demonstrated knowledge, skills, and practical experience in:
• ZTNA and Zero Trust principles, including identity and device trust, conditional access, least privilege, segmentation, and continuous verification, network access control (NAC), and privileged access management (PAM).
• NDR and network-security monitoring, including network protocols, the OSI model, DNS, web, email, remote access, and encrypted-traffic analysis, network segmentation, traffic-flow analysis, and anomaly detection.
• XDR and endpoint investigation across Windows and Linux, including host telemetry, identity activity, persistence, malicious behavior, and containment actions.
• SIEM, SOAR, UEBA, EDR/XDR, NDR, CNAPP, vulnerability management, exposure management, email security, and network-monitoring technologies.
• Cloud and CNAPP capabilities, including workload protection, cloud-security posture, identity and entitlement risk, and cloud-native threat detection.
• Email architecture and flow, including SMTP, DNS, mail gateways, message headers, SPF, DKIM, DMARC, phishing, spoofing, and business email compromise.
• Log and telemetry analysis across identity, endpoint, network, email, application, and cloud sources to identify root cause, affected assets, attack paths, and remediation.
• Incident response, vulnerability and patch management, system hardening, configuration management, exposure management, and operational resiliency.
• MITRE ATT&CK, Cyber Kill Chain, NIST Cybersecurity Framework, CIS Controls, and ISO/IEC 27000-series controls.
• Clear written and verbal communication, including management briefings, project and operational updates, incident reporting, coaching conversations, and cross-team coordination.
• KQL, Python, PowerShell, Bash, or SQL would be an asset. Relevant certifications such as GCIH, GCIA, GCFA, CISSP, Security+, or SC-200, CISM, CRISC, AZ-500, or comparable security-focused certifications would also be an asset.

Leadership approach:
We are looking for a collaborative, service-oriented leader who combines hands-on technical credibility with sound judgment, accountability, empathy, and proactive communication. The successful candidate will treat other teams as partners, set clear expectations, develop people through coaching and training, and create an environment of ownership and continuous improvement. This role is well suited to someone with an initial foundation in technical leadership who is ready for substantially more responsibility and continued growth.

About us

At ICBC, it’s our job to make sure the car insurance system works for everyone in British Columbia, today and in the future. If you want to make the most of your skills and expertise while growing your career, we want you. A career at ICBC is an opportunity to be part of a talented, diverse and inclusive team that is driven to serve its customers and community. You can expect a competitive salary, comprehensive benefits and a collaborative work environment. If you are reliable and dependable, apply today to be part of our talented and diverse team as we work together to create an insurance system we can all be proud of.

Work arrangements defined

• Hybrid 8 – you will work a minimum of 2 days per week at your primary in-office headquarters, subject to operational requirements. The remaining days will be remote within British Columbia.

ICBC Head Office Relocation

This role is currently based at our Head Office in North Vancouver. In Spring/Summer 2027, the role will relocate to our new Head Office at 2150 Keith Drive in Vancouver, conveniently located next to VCC–Clark SkyTrain Station on the Millennium Line.

Benefits

ICBC provides comprehensive benefit coverage to all eligible permanent full time bargaining unit employees including a defined benefit pension plan and 3 weeks’ vacation, plus up to 16 days of time off.

• Extended Health and dental coverage (no premiums)
• Employee and Family assistance program (wellness support)
• Basic group life insurance
• Voluntary group life insurance
• Critical Illness insurance
• Sick leave plan – 100% of pay for a period of a maximum of 150 hours
• Long term disability plan
• Pension plan – defined benefit pension plan that pays a benefit to you or your beneficiary upon termination, death, or retirement.
• Benefits for part-time employees may be pro-rated, with benefit costs shared between ICBC and the employee.

BU benefits are determined by the collective agreement and may change from time to time based on collective bargaining negotiations.

Only candidates legally entitled to work in Canada will be considered for this position.

#IND1