Information Security Specialist - Cyber Security Incident Response

TD; Canada; On-site; CAD 96,000 - 137,000; Full time

Job summary

A leading financial institution in Canada is seeking an Information Security Specialist to join the Cyber Security Incident Response Team. The role includes leading cyber threat investigations, developing detection techniques, and enhancing incident response strategies. Candidates must have over 7 years of hands-on experience in IT security and incident management, with strong skills in SIEM and advanced operating systems. This position is critical in safeguarding the organization against cyber threats.

Qualifications

• 7+ years relevant, hands-on experience.
• Advanced experience with modern operating systems.
• Eligibility for employment under regulatory standards.

Responsibilities

• Lead cybersecurity incidents and events.
• Guide partners on technology throughout incidents.
• Develop ongoing operational enhancements.

Skills

Expert knowledge of IT security

Incident management

Strong experience with SIEM, EDR, XDR

Advanced scripting skills

Excellent communication skills

Education

University degree or equivalent hands-on experience

Tools

SIEM

EDR

CrowdStrike

Splunk

Job description

Work Location

Toronto, Ontario, Canada

Hours

37.5 hours per week

Line of Business

Technology Solutions

Pay Details

$96,900 - $136,800 CAD (base salary)

Job Description

Information Security Specialist – Cyber Security Incident Response Team (CSIRT)

Play a critical role in detecting, investigating, and responding to cyber threats targeting TD. Lead complex investigations, develop detection and hunting techniques, and strengthen incident‑response capabilities.

Essential Responsibilities

• Guide partners on technology throughout incidents
• Lead cybersecurity incidents and events
• Contribute to containment and recovery plans for incidents
• Help define, develop, and oversee a global security management strategy and framework
• Ensure technology, processes, and governance monitor, detect, prevent, and react to current and emerging threats
• Develop ongoing operational enhancements – alerting, monitoring, and detection across multiple security domains
• Adhere to internal policies, technology control standards, and regulatory guidelines
• Review internal processes, identify improvement opportunities
• Enforce enterprise frameworks and methodologies related to technology controls and information security
• Influence culture to reduce risk and foster strong risk management

Job Requirements

• University degree or equivalent hands‑on experience
• 7+ years relevant, hands‑on experience
• Expert knowledge of IT security and incident management across multiple cybersecurity domains
• Strong experience with SIEM, EDR, XDR, firewall, WAF, email proxies, NIDS, and equivalents
• Advanced experience with modern operating systems (Windows, Unix/Linux, cloud, mobile)
• Advanced scripting skills; ability to read data structures and binary code
• Advanced knowledge of enterprise security controls, cyber risk, and governance
• Excellent communication, leadership, and people‑building skills
• Ability to participate in complex, large projects
• Leadership role as an expert in technology controls and information security for project teams and vendors
• Eligibility for employment under regulatory standards applicable to the position

Preferred Qualifications

• Extensive experience as an incident commander or manager on complex cybercrime incidents
• Experience handling network layer‑7/application and internet‑facing attacks
• Briefing senior executives on cybercrime incident triage, containment, and recovery
• Authoring complex communications for incident triage and recovery
• Maintaining electronic and operational playbooks, governance documentation
• Knowledge of NIST Cybersecurity Framework, SANS Top 20 Controls, OWASP Top 10, MITRE ATT&CK
• Expert knowledge of SIEM/UEBA solutions (Splunk, Azure Sentinel); experience with CrowdStrike, MS Defender, XSOAR
• Forensics tools expertise (Encase, Axiom, Autopsy, FTK Imager, etc.)
• Certifications such as GIAC (GCIA, GPEN, GWAPT, GCIH, GSEC, GCFA), CCNP, CCNA, CISSP, Cloud Security

Office and Shift Requirements

Work within a 24×7 security monitoring operations team using a rotating shift schedule that includes occasional on‑call, weekend, and night support.