Senior Security Analyst

PBC Solutions is looking for a full-time Senior Security Analyst!

Please note: PBC Solutions is headquartered in Saanichton, BC (a suburb of Victoria) and also has offices in Burnaby. We operate in a hybrid in-person and virtual environment. The successful candidate must be based on southern Vancouver Island or in the Lower Mainland, with regular office presence required. Preference will be given to candidates based in the Greater Victoria area.

While the initial focus of the role will be on delivery of BC Ministry of Health-related projects, efforts may expand to additional public and private client work.

Position Summary:
Reporting to the Manager, Information Security, the Senior Security Analyst is PBC Solutions' primary in-house resource for conducting Security Threat and Risk Assessments (STRAs). The role scopes, performs and documents STRAs for new and changing systems, services, vendors and technology-enabled business processes that support PBC Solutions' health-benefits administration services, and produces clear, defensible risk findings and recommendations for business owners and leadership.
The analyst completes routine and moderate STRAs end to end and coordinates with specialist assessment partners on more complex engagements. Secondary responsibilities include supporting security reviews of AI-enabled and application initiatives, validating controls in the Microsoft security environment (including Microsoft Defender), and improving the STRA process, templates and tracking.

Key Accountabilities:
Security Threat and Risk Assessments (approx. 65%)

• Lead STRAs from intake to approval: work with various groups to confirm scope, identify information assets, data flows and trust boundaries, and determine assessment depth.
• Gather and review evidence from project teams, vendors and service providers; identify threats, vulnerabilities and control gaps.
• Develop and maintain guidance, templates, and supporting materials to facilitate the STRA process for project teams.
• Assess, track and rate risk, write clear risk statements, and recommend practical, proportionate safeguards.
• Document residual risk, risk-acceptance decisions, exceptions and conditions of approval, and track treatment actions to closure.
• Apply applicable BC Government IM/IT standards (including the STRA standard), contractual security obligations and PBC Solutions policies.
• Work alongside Privacy on related Privacy Impact Assessments so security and privacy findings are aligned.
• Coordinate with external assessment partners on complex STRAs, including scoping, progress status, quality review and integration of their findings.
• Maintain the STRA register and status reporting for the Information Security team and leadership.

Security Reviews for AI, Application and Vendor Initiatives (approx. 15%)

• Provide security input on AI use cases, pilots and procurements using PBC Solutions' AI governance and security review checklists.
• Review application security considerations such as authentication, access control, data protection, secure configuration and integration points.
• Support vendor and SaaS/cloud security due diligence and follow up on remediation commitments.

Security Controls and Microsoft Security Environment (approx. 10%)

• Use Microsoft Defender and related Microsoft 365 and Azure security tools to validate controls, gather evidence and inform risk ratings.
• Review security alerts, findings and reports as assigned, and coordinate remediation with operational owners and service providers.

Process Improvement and Stakeholder Coordination (approx. 10%)

• Improve STRA intake, templates, workflows and tracking so assessments are consistent, timely and measurable.
• Translate security requirements into clear actions for project, business and technical stakeholders, and escalate risks or blockers promptly.

Required Education and Experience:

• Bachelor's degree in computer science, information technology, cybersecurity, risk management or a related field, or an equivalent combination of education and experience.
• Five or more years of progressive experience in information security, technology risk, IT audit or a related field.
• Demonstrated hands-on experience conducting security threat and risk assessments (or equivalent technology risk assessments) and writing defensible findings and recommendations.
• Experience assessing cloud, SaaS and vendor-provided solutions.
• Experience working with technical, business and vendor teams in a regulated or public-sector environment.

Preferred Qualifications:

• CISSP and/or CCSP certification is considered a valuable asset; other recognized security or risk certifications (e.g., CISM, CRISC, GIAC) are also an asset.
• Background in AI security, including assessing AI-enabled or machine-learning solutions, data handling and AI-specific risks, is a value add.
• Relevant Microsoft security certifications are a nice to have, such as Microsoft Certified: Information Security Administrator Associate (SC-401, Microsoft Purview) and Microsoft Certified: Security Operations Analyst Associate (SC-200, Microsoft Defender).
• Working knowledge of Microsoft Defender and Microsoft Purview and the broader Microsoft 365 / Azure security stack.
• Knowledge of application security practices, such as OWASP Top 10, secure design review, threat modelling and API security.
• Experience with the BC Government STRA standard or other public-sector risk assessment frameworks.
• Experience in healthcare, benefits administration or other environments handling sensitive personal information.

Knowledge, Skills, and Abilities:

• Strong knowledge of security risk assessment methods and control frameworks such as NIST Cybersecurity Framework, ISO/IEC 27001/27002 and NIST SP 800-30.
• Sound understanding of identity and access management, network and cloud security, data protection, encryption, logging and vulnerability management.
• Ability to read architecture diagrams, data flows and vendor security documentation and quickly identify key risks.
• Excellent written communication; able to produce concise, decision-ready assessments for technical and non-technical readers.
• Ability to manage several assessments at once, prioritize effectively and meet deadlines with limited supervision.

Required Competencies:

• Analytical judgement: Weighs incomplete or competing information and reaches clear, risk-based conclusions.
• Communication: Writes clear assessments and explains risk in plain language to business owners and leaders.
• Collaboration: Builds productive working relationships with project teams, vendors and partners without relying on formal authority.
• Accountability: Keeps accurate records, follows through on commitments and escalates risks or blockers promptly.
• Continuous improvement: Looks for practical ways to simplify, standardize and strengthen the assessment process.

Travel/Work Location:
PBC Solutions is headquartered in Saanichton, BC (a suburb of Victoria) and also has offices in Burnaby. We operate in a hybrid in-person and virtual environment. The successful candidate must be based on southern Vancouver Island or in the Lower Mainland, with regular office presence required. Preference will be given to candidates based in the Greater Victoria area.

What's in it for you
We offer market competitive total compensation, including an annual incentive bonus plan and market-based salaries. The base salary range for this position is $76,800 - $115,200. Placement in the salary range will be determined by the level of experience and expertise based on corporate guidelines, with the goal to ensure market competitiveness and internal equity.

We offer a robust health & dental benefits plan, with flexible options that will meet you and your family's needs. We also offer generous vacation and paid leaves along with a Defined Benefit Pension Plan (PSPP), for all eligible employees.

Does this opportunity resonate with you?
Are you seeking a work environment that will challenge you, provide stretch opportunities, and support your success and growth? Then you've found your ideal work environment - Apply today please! We'd love to talk with you to explore this opportunity further with you.

This posting will be open until filled. We will start reviewing applications on November 23, 2026, and will continue to receive applications until the position is filled

How we work:
Our Guiding Principles
Honesty - We will be truthful.We will create a safe environment to communicate proactively, openly and with respect.We will be transparent and genuine with our interests.
Integrity - We will act consistently to do the right thing and ensure our words and actions align.Embracing opportunities and challenges, we will live our shared values and vision.
Reciprocity - We will strive for fair and balanced exchanges leveraging our unique strengths and resources, recognizing this requires an ongoing give and take.We will win and lose as one.
Autonomy - We respect and acknowledge the interests of each party.We trust each other to make decisions and act based on our diverse strengths to achieve our mutually desired outcomes.
Loyalty - We will be bold, brave, and committed to our relationship.As partners, we will advocate for one another, celebrate our successes, and have each other's back through our challenges.
Equity - We commit to a balanced partnership.We will make decisions and act based on a fair assessment of capabilities, risks, constraints, and opportunities to achieve mutual success.

Our Intended Behaviours
Communication - We actively communicate in a timely, open, respectful, and responsive manner with the intent to gain understanding and find solutions.
Flexibility - We will be agile, adaptable, and creative to enable responsive service delivery and embrace challenges and change with an open-minded and positive attitude.
Perspective - We seek to understand interests, assumptions, actions, and diverse backgrounds by actively sharing and exploring all points of view.
Focus - We will use our Shared Vision as our North Star to evaluate, prioritize, and deliver successful results.
Trust & Confidence - We lead with trust.We consistently behave in ways that earn and inspire confidence by being credible, reliable, and transparent even when vulnerable.
Feedback - No surprises.We will maintain a strong relationship through timely, purposeful feedback in a safe, respectful, and collaborative environment.
Solution-oriented - We see possibilities rather than limitations.We use our diverse capabilities to develop options to resolve our challenges.