T

TD Bank

Offers banking, loans, and wealth management.

Information Security Specialist - Attack Surface Reduction, Cyber Threat Hunting

Security Operations & Incident ResponsePosted on Nov 13
Full-timeToronto, ON, CanadaCA$96.9k - CA$136.8kIn-person

About the Job

Requirements

  • A bachelor's degree or equivalent experience in an IT- or cyber-related field is required; a master's degree is preferred.
  • At least 7 years of cybersecurity experience is required.
  • Expert knowledge of log management, security analytics, and security information and event management platform mechanics is required.
  • Experience with security information and event management, security orchestration, automation and response, endpoint detection and response, cloud-native tools, and other cybersecurity toolsets is required.
  • Advanced knowledge of endpoint and identity architectures, operations, and investigations is required.
  • Proficiency in security incident and event management and endpoint detection and response tools, including Splunk Enterprise Security, CrowdStrike, LogScale, Microsoft Defender for Endpoint, Microsoft Sentinel, and Wiz Defend, is required.
  • A deep understanding of coding, scripting, and application programming interfaces in support of investigations, localized automation, and integrations is required.
  • The ability to identify and generate detection logic is required.
  • Hands-on experience writing and implementing complex analytics queries, threat visualization dashboards, and large-volume data analysis using tools such as Splunk, LogScale, Kusto Query Language, and syslog is required.
  • Strong working knowledge of security-relevant data, including network protocols, ports, common services, transmission control protocol/internet protocol, and application-layer protocols such as HTTP/S, DNS, FTP, SMTP, and Active Directory is required.
  • Extensive knowledge of Windows, Mac, and Linux endpoints, including operating systems, services, file systems, and agents, is required.
  • Strong written and oral communication, organizational, and self-direction skills are required.
  • The ability to initiate, coordinate, and prioritize responsibilities, complete tasks, and work independently on varied assignments with minimal supervision is required.

Responsibilities

  • Hunt threats, risks, and vulnerabilities aligned with the MITRE ATT&CK framework using internal and external intelligence data.
  • Proactively identify potential enterprise threats, risks, and security control gaps, and produce detection and mitigation recommendations to reduce the bank's attack surface.
  • Participate in proactive attack surface reduction operations across the enterprise and cloud by using threat intelligence, analyzing anomalous log data, and using brainstorming-session results to detect and mitigate threats.
  • Develop advanced methodologies to identify adversary tools, techniques, and procedures.
  • Produce metrics and develop dashboards to identify potential threats, suspicious or anomalous activity, and malware.
  • Drive tuning of detection infrastructure with technology teams to identify emerging threats.
  • Document best practices to improve hunting playbooks, procedures, and courses of action.
  • Serve as a subject matter expert in host-based and network-based threat hunting, working cross-functionally with intelligence, security operations center analysts, incident response, and security engineering peers.
  • Review internal processes and activities to identify opportunities for improvement.
  • Influence behavior to reduce risk and foster an information security management culture across the enterprise.
  • Stay informed about emerging issues, industry trends, and relevant changes to the security landscape.

Desired Qualifications

  • At least 3 years of experience in malware reverse engineering, threat hunting, digital forensics and incident response, threat detection, or threat intelligence is preferred.
  • Cloud threat-hunting experience is preferred.
  • Python experience is a plus.
  • Experience with Netskope, Akamai, AppOmni, Qualys, and Symantec data loss prevention is optional or good to have.
  • The ideal or preferred candidate will have obtained at least two certifications from the listed cybersecurity, endpoint/forensics, cloud, penetration-testing, or coding/scripting/SIEM certification options.

About the Company

TD Bank

Offers banking, loans, and wealth management.

TD Bank provides a wide range of banking and financial services in North America for individuals, businesses, and corporations. Core offerings include checking and savings accounts, credit cards, loans, mortgages, investment products, and wealth management. TD Bank emphasizes digital banking through online and mobile apps that let customers manage money, pay bills, deposit checks, transfer funds, and manage cards. Revenue comes from interest on loans, service fees, and investment income. The company differentiates itself with a broad product lineup, large North American footprint, and integrated services for both personal and business customers, plus a focus on digital accessibility. Its goal is to be a leading, accessible financial institution that helps customers manage and grow their money through convenient, everyday banking and investment solutions.

Company size
10,001+
Company stage
IPO
Headquarters
Toronto, Canada
Founded
1955

Recently Posted Jobs

Explore more opportunities at TD Bank

See more jobs