Security Operations Analyst

officeally; Vancouver; On-site; CAD 90,000 - 120,000; Full time

Job summary

Office Ally is a cloud-based healthcare technology company focused on revenue cycle management and security. The Security Operations Analyst will serve as the first line of defense, monitoring and triaging alerts across SIEM, EDR, identity, email security, and data protection.

This is a hands-on role with ownership over incidents and runbook development. You will work with security engineering, cloud infrastructure, and IT operations to investigate threats, coordinate responses, and maintain

Responsibilities

• Monitor security incidents, assess severity, investigate context, and document actions.
• Investigate endpoint alerts, review timelines and file events, initiate live responses.
• Analyze internal alerts for risky OAuth apps, unusual downloads, shadow IT, and policy violations.
• Coordinate investigations by correlating logs, UBA alerts, and remediation of findings.
• Document incidents in tickets for audit evidence and post-incident review.
• Triage phishing, attachments, BEC, and user-reported messages.
• Review email threat findings and coordinate remediation such as recall, blocking senders, and user notification.
• Monitor chat/file sharing for anomalies, external risks, and DLP hits.
• Run KQL hunting queries to identify threats not surfaced by automated rules.
• Analyze logs across sign-ins, device events, email transport, and cloud activity.
• Investigate identity logs for login anomalies, lateral movement indicators, Kerberos abuse, and unusual auth patterns.
• Identify false positives and help tune suppression for high-volume alerts.
• Review sign-in logs and CA results for compromised accounts, token abuse, MFA gaps, auth anomalies.
• Support identity incidents including AD lockouts, account compromise response, and offboarding.
• Verify Intune device compliance; flag unmanaged/non-compliant devices.
• Identify stale sessions, unrevoked tokens, and privilege inconsistencies.
• Respond to DLP incidents across mail/file shares and coordinate with data owners.
• Support compliance activities including control evidence collection and audits.

Job description

About Us

At Office Ally, we've been revolutionizing healthcare administration since our inception. What started as a clearinghouse focused on simplifying insurance claims processing for healthcare providers has grown into a full-suite healthcare technology company. We offer a range of affordable, cloud-based revenue cycle management solutions -from eligibility verification and claims management to revenue recovery and payment processing -that help healthcare organizations of all sizes streamline operations and reduce administrative burdens so they can focus on what matters most: patient care.

In April 2026, Office Ally acquired Jopari Solutions, Inc, a leader in straight-through electronic claims processing for Property & Casualty (P&C), Commercial, and Government healthcare. Jopari brings deep industry expertise and innovative enterprise payment solutions that are transforming how disbursements are handled across the insurance ecosystem. Together, we are expanding our capabilities across the full healthcare transaction lifecycle, connecting claims, payments, and data exchange to deliver a more seamless and efficient experience for providers, payers, and partners.

At the core of our company are four key values that guide our mission and work:

• Ownership : We take pride in our responsibilities, driving results and taking accountability for the success of our projects.


• Empowerment : We believe in giving our team the autonomy and support to make decisions that lead to innovative solutions.


• Innovation : We continuously seek new and better ways to improve healthcare administration, embracing creativity and forward-thinking technology.


• Transparent Communication : Open, honest communication is at the heart of our collaborations, internally and with our clients, ensuring alignment and trust.

About the Role

The Security Operations Analyst serves as the first line of defense for Office Ally's security program, monitoring and triaging alerts across a broad set of security platforms spanning SIEM, endpoint detection and response, identity, email security, and data protection. This is a hands-on role with real ownership: you'll close incidents, investigate anomalies, and help build the runbooks and detection logic that make the next response faster.

This role works closely with the security engineering team, cloud infrastructure, and IT operations to investigate threats, coordinate response actions, and maintain the audit trail required by our applicable regulatory and compliance obligations.

What You'll Do

Incident Triage & Response

• Monitor and triage security incidents across our environment - assessing severity, investigating context, and closing or escalating with clear, complete documentation


• Investigate Endpoint alerts: review device timelines, process trees, and file events; initiate live response sessions when needed


• Analyze Internal alerts - risky OAuth applications, unusual download activity, shadow IT, and policy violations


• Manage Security investigations - correlate log data, track User Behavior Analytics alerts, and coordinate vulnerability findings through triage and remediation


• Track and document all incidents in tickets, maintaining complete investigative records that serve as audit evidence and support post-incident review

Email & Collaboration Security

• Triage - phishing, malicious attachments, BEC attempts, and user-reported messages


• Review email threat investigation findings and coordinate remediation actions including message recall, sender block, and user notification


• Monitor chat and file share activity for anomalous sharing behavior, external collaboration risks, and DLP policy hits

Threat Detection & Hunting

• Run advanced hunting queries (KQL) to investigate indicators of compromise and identify threats not surfaced by automated rules


• Perform log analysis across sign-in logs, MDE device events, email transport logs, and cloud activity logs


• Use Identity logs to investigate on-premises login anomalies - lateral movement indicators, Kerberos abuse, and unusual authentication patterns


• Identify patterns of false positives and contribute to tuning requests and suppression logic for high-volume alert sources

Identity & Access Monitoring

• Review sign-in logs and Conditional Access policy results to identify compromised accounts, token abuse, MFA gaps, and authentication anomalies


• Support identity-related incidents including AD lockout investigation, account compromise response, and offboarding verification


• Verify Intune device compliance state during investigations - flag unmanaged or non-compliant devices involved in security events


• Identify accounts with stale sessions, unrevoked tokens, or privilege inconsistencies and elevate for remediation

Data Protection & Compliance

• Respond to DLP incidents across mail and file share, coordinating with data owners on sensitive data policy violations


• Support compliance program activities including control evidence collection, audit l