BAND 3 - Manager, IT Security Operations - Closing date extended

Province of British Columbia

7d•Remote

About The Position

The Security Operations Center (SOC) protects government systems, services, information, and technology through a comprehensive suite of cybersecurity capabilities, including security operations, cyber incident response, threat intelligence, investigations, and digital forensics. Working in a dynamic and rapidly evolving environment, the team collaborates with technical experts, operational partners, vendors, and law enforcement agencies to strengthen the Province’s cybersecurity readiness, resilience, and ability to respond to emerging threats. The Security Operations Manager leads critical cybersecurity functions, including the Security Operations Centre, cyber incident response, threat intelligence, security investigations, and digital forensics services. This role provides strategic and operational leadership to advance 24/7 security operations, enhance detection and automation capabilities, oversee staff and service providers, and advise senior leadership on cyber risks, incidents, and response strategies that help protect the digital services and information relied upon by British Columbians.

Requirements

Degree, diploma, certification in computer science or other related technical field, or equivalent in education and experience.
At least three (3) years’ of progressive cybersecurity and leadership experience including:
Experience leading diverse cybersecurity functions within complex enterprise environments, including security operations, investigations, cyber incident response, threat intelligence, security data analytics, and/or other blue and red team activities, in addition to the overseeing or integrating managed security services.
Experience of modern Security Operations Centre (SOC) operating models, including AI-assisted operations, autonomous and agentic SOC capabilities, 24/7 and continuous operations models, and the design and orchestration of automated security workflows supporting threat detection, investigation, response, and continuous improvement.
Experience identifying and assessing IT and cybersecurity risks, current and emerging threats, and security incidents, with a strong understanding of the incident response lifecycle, incident management practices, and security investigations.
Experience with security technology (e.g., Anti-DDoS, firewalls, EDR, CNAPP, Zero Trust, etc.), SIEM / SOAR (or other data analytics platforms), threat intelligence platforms, case management, etc.
Strong communication and partner engagement experience.
A minimum of two (2) years of relevant work experience in progressively complex technology-enabled environments (e.g., in a service environment with multiple client groups).
A minimum of two (2) years' experience leading significant IT project implementations.
A minimum of three (3) years' experience managing professional staff, project teams, budgets, and cross-functional initiatives.

Nice To Haves

Demonstrated commitment to continuous professional development through progressively advanced training and industry-recognized certifications.
Technical cybersecurity certifications relevant to security operations, incident response, threat hunting, digital forensics, or detection engineering (e.g., GCIH, GSOC, GMON, GCFA, GCFE, GDAT, or equivalent).
Professional security designation such as Certified Information Systems Security Professional (CISSP), or Certified Information Security Manager (CISM).

Responsibilities

Leads critical cybersecurity functions, including the Security Operations Centre, cyber incident response, threat intelligence, security investigations, and digital forensics services.
Provides strategic and operational leadership to advance 24/7 security operations.
Enhances detection and automation capabilities.
Oversees staff and service providers.
Advises senior leadership on cyber risks, incidents, and response strategies.
Bringing innovations as part of the existing tool footprint, maximizing usage of SOC tools and reducing false positives.
Crisis management, with the ability to remain composed and provide leadership during high-pressure security incidents, investigations, and cyber events.
Developing, mentoring, and leading high-performing teams.
Managing professional staff, project teams, budgets, and cross-functional initiatives.