About UsAt Office Ally, we’ve been revolutionizing healthcare administration since our inception. What started as a clearinghouse focused on simplifying insurance claims processing for healthcare providers has grown into a full-suite healthcare technology company. We offer a range of affordable, cloud-based revenue cycle management solutions –from eligibility verification and claims management to revenue recovery and payment processing –that help healthcare organizations of all sizes streamline operations and reduce administrative burdens so they can focus on what matters most: patient care.In April 2026, Office Ally acquired Jopari Solutions, Inc, a leader in straight-through electronic claims processing for Property & Casualty (P&C), Commercial, and Government healthcare. Jopari brings deep industry expertise and innovative enterprise payment solutions that are transforming how disbursements are handled across the insurance ecosystem. Together, we are expanding our capabilities across the full healthcare transaction lifecycle, connecting claims, payments, and data exchange to deliver a more seamless and efficient experience for providers, payers, and partners.At the core of our company are four key values that guide our mission and work:Ownership : We take pride in our responsibilities, driving results and taking accountability for the success of our projects.Empowerment : We believe in giving our team the autonomy and support to make decisions that lead to innovative solutions.Innovation : We continuously seek new and better ways to improve healthcare administration, embracing creativity and forward-thinking technology.Transparent Communication : Open, honest communication is at the heart of our collaborations, internally and with our clients, ensuring alignment and trust.About the RoleThe Security Operations Analyst serves as the first line of defense for Office Ally's security program, monitoring and triaging alerts across a broad set of security platforms spanning SIEM, endpoint detection and response, identity, email security, and data protection. This is a hands‑on role with real ownership: you'll close incidents, investigate anomalies, and help build the runbooks and detection logic that make the next response faster.This role works closely with the security engineering team, cloud infrastructure, and IT operations to investigate threats, coordinate response actions, and maintain the audit trail required by our applicable regulatory and compliance obligations.What You’ll DoIncident Triage & ResponseMonitor and triage security incidents across our environment - assessing severity, investigating context, and closing or escalating with clear, complete documentationInvestigate Endpoint alerts: review device timelines, process trees, and file events; initiate live response sessions when neededAnalyze Internal alerts - risky OAuth applications, unusual download activity, shadow IT, and policy violationsManage Security investigations - correlate log data, track User Behavior Analytics alerts,



and coordinate vulnerability findings through triage and remediationTrack and document all incidents in tickets, maintaining complete investigative records that serve as audit evidence and support post-incident reviewEmail & Collaboration SecurityTriage - phishing, malicious attachments, BEC attempts, and user-reported messagesReview email threat investigation findings and coordinate remediation actions including message recall, sender block, and user notificationMonitor chat and file share activity for anomalous sharing behavior, external collaboration risks, and DLP policy hitsThreat Detection & HuntingRun advanced hunting queries (KQL) to investigate indicators of compromise and identify threats not surfaced by automated rulesPerform log analysis across sign-in logs, MDE device events, email transport logs, and cloud activity logsUse Identity logs to investigate on-premises login anomalies - lateral movement indicators, Kerberos abuse, and unusual authentication patternsIdentify patterns of false positives and contribute to tuning requests and suppression logic for high-volume alert sourcesIdentity & Access MonitoringReview sign-in logs and Conditional Access policy results to identify compromised accounts, token abuse, MFA gaps, and authentication anomaliesSupport identity-related incidents including AD lockout investigation, account compromise response, and offboarding verificationVerify Intune device compliance state during investigations - flag unmanaged or non-compliant devices involved in security eventsIdentify accounts with stale sessions, unrevoked tokens, or privilege inconsistencies and elevate for remediationData Protection & ComplianceRespond to DLP incidents across mail and file share, coordinating with data owners on sensitive data policy violationsSupport compliance program activities including control evidence collection, audit log review, and documentation of security control operationFlag potential data exposure events and elevate to security engineering with complete investigative contextDocumentation & Process ImprovementWrite and maintain SOC runbooks and incident response procedures, keeping documentation current as the environment evolvesContribute to playbook improvements and false-positive suppression logic based on real triage experienceMaintain accurate ticket incident records that support compliance audit trails and post-incident reviewWhat You’ll NeedBachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent experience or relevant industry certifications2+ years in a SOC, IT security,



or incident response roleWorking knowledge of Microsoft Sentinel and the Microsoft Defender suite (MDE, MCAS, Defender for Identity, Defender for Office 365)Ability to read and write KQL - comfortable building hunting queries and modifying analytics rulesUnderstanding of Active Directory and Entra ID fundamentals: sign-in flows, token lifetimes, Conditional Access, and MFAFamiliarity with email-based threat investigation - phishing triage, header analysis, and safe/unsafe sender managementWorking knowledge of SOC 2, HIPAA, or HITRUST requirements and the role security operations plays in maintaining complianceClear written communication - your incident notes are part of the compliance audit trailAbility to manage competing priorities in a fast-moving alert environment without losing investigative rigorNice to HaveRapid7 InsightIDR experience - LEQL queries, investigation dashboards, UBA alert triageExposure to Palo Alto or similar NGFW log analysisFamiliarity with Microsoft Intune device compliance and endpoint management conceptsCompTIA Security+, SC-200 (Microsoft Security Operations Analyst), or equivalent certificationExperience with PowerShell for basic automation, log parsing, and remediation scriptingPrior experience supporting SOC 2 Type II, HITRUST, or HIPAA audit evidence collectionHealthcare, SaaS, or regulated industry backgroundExperience working in Jira for incident tracking and workflow managementTravel RequirementsThis role requiresup to 5% travel, which may include client meetings, team gatherings, or company events.Travel will typically be scheduled in advance and supported by the company.Pay TransparencyOffice Ally is committed to fair and equitable compensation practices in alignment with pay transparency laws. Compensation for this position may vary based on individual skills, experience, and location. In addition to base pay, employees may be eligible for performance-based bonuses and a comprehensive benefits package, including medical, dental, and vision coverage, 401(k) with company match, paid time off, and other advantages. Actual compensation will be determined considering the candidate’s qualifications, relevant experience, and internal equity.$90,000 – $100,000 USDWhy You’ll Love Working at Office AllyAt Office Ally, your work has a direct impact on healthcare providers and their ability to deliver exceptional care. We’re driven by a mission to simplify healthcare administration, making it easier for providers to focus on what they do best—helping patients. As an Office Ally employee, you’ll be at the heart of our efforts to deliver exceptional service and software solutions to our clients in the healthcare space.EEO NoteOffice Ally is an Equal Prospect Employer and does not discriminate against any employee or applicant on the basis of age, color, disability, gender, national origin, race, religion, sexual orientation, veteran status, or any classification protected by federal, state, or local law.#J-18808-Ljbffr

📌 Security Operations Analyst - $90,000 - $100,000 A Year (Winnipeg)
🏢 Epic Games
📍 Winnipeg