Senior Information Security Analyst - Detection Engineering

TD Bank; Toronto; On-site; CAD 82,000 - 115,000; Full time

Job summary

TD Bank Group in Toronto is seeking a Senior Information Security Analyst to support enterprise cybersecurity monitoring, detection engineering, and security operations improvement. You will develop and maintain detections, tune alerts, and enhance detection coverage using Microsoft Sentinel and Splunk.

The role requires hands-on experience with the Microsoft security ecosystem, familiarity with cloud and identity security concepts, and strong collaboration with SOC and engineering teams to

Qualifications

• Experience in cybersecurity, security monitoring, SOC operations, incident response, threat hunting, or detection engineering.
• Hands-on experience with Microsoft Sentinel and familiarity with the broader Microsoft security suite.
• Working knowledge of Splunk and the ability to review or support SIEM-based detections and investigations.
• Strong understanding of cybersecurity fundamentals, including common attack techniques, security controls, incident investigation, and risk-based thinking.
• Familiarity with cloud security concepts, especially around identity, access, logging, monitoring, and misconfiguration risks.
• Understanding of security telemetry from identity, endpoint, network, email, cloud, and application environments.
• Ability to assess whether alerts are accurate, actionable, and useful for security operations.
• Strong analytical, troubleshooting, communication, and documentation skills.

Responsibilities

• Support the development, review, tuning, and maintenance of security detections across SIEM and security monitoring platforms.
• Analyze security events, alerts, and telemetry to identify suspicious activity, detection gaps, and opportunities for improvement.
• Apply detection engineering principles to improve alert fidelity, reduce unnecessary noise, and ensure detections are practical for security operations.
• Work with Microsoft Sentinel, Microsoft Defender products, Microsoft Entra ID, and related security tools to support threat detection and investigation use cases.
• Use Splunk to review security data, support investigations, and assist with detection tuning where required.
• Apply cybersecurity knowledge across identity, endpoint, cloud, network, email, and application security domains.
• Collaborate with SOC, incident response, security engineering, and technology teams to understand monitoring needs and improve security outcomes.
• Document detection logic, assumptions, data sources, tuning decisions, and investigation guidance in a clear and maintainable way.
• Support ongoing assessment of detection effectiveness, including relevance, actionability, coverage, and operational value.

Skills

Cybersecurity basics

Security monitoring

Incident response

Threat hunting

Analytical skills

Documentation

Cross-team collaboration

Communication

Tools

Microsoft Sentinel

Microsoft Defender

Microsoft Entra ID

Splunk

Job description

Work Location: Toronto, Ontario, Canada
Hours: 37.5
Line of Business: Technology Solutions
Pay Details: $81,600 - $115,200 CAD

TD is committed to providing fair and equitable compensation opportunities to all colleagues. Growth opportunities and skill development are defining features of the colleague experience at TD. Our compensation policies and practices have been designed to allow colleagues to progress through the salary range over time as they progress in their role. The base pay actually offered may vary based upon the candidate's skills and experience, job-related knowledge, geographic location, and other specific business and organizational needs.

As a candidate, you are encouraged to ask compensation related questions and have an open dialogue with your recruiter who can provide you more specific details for this role.

Job Description

We are seeking a Senior Information Security Analyst to support enterprise cybersecurity monitoring, detection engineering, and security operations improvement. This role will help develop and maintain effective security detections, improve alert quality, support threat detection activities, and contribute to the overall maturity of security monitoring capabilities.

The successful candidate should have a strong cybersecurity foundation, practical experience with SIEM platforms, and familiarity with cloud, identity, endpoint, and network security concepts. The role requires hands‑on experience with Microsoft Sentinel and the Microsoft security ecosystem , along with working knowledge of Splunk . The candidate should be able to analyze security events, understand attack behaviours, tune detections, and work with operational teams to improve detection coverage and investigation outcomes.

Key Responsibilities

• Support the development, review, tuning, and maintenance of security detections across SIEM and security monitoring platforms.
• Analyze security events, alerts, and telemetry to identify suspicious activity, detection gaps, and opportunities for improvement.
• Apply detection engineering principles to improve alert fidelity, reduce unnecessary noise, and ensure detections are practical for security operations.
• Work with Microsoft Sentinel, Microsoft Defender products, Microsoft Entra ID, and related security tools to support threat detection and investigation use cases.
• Use Splunk to review security data, support investigations, and assist with detection tuning where required.
• Apply cybersecurity knowledge across identity, endpoint, cloud, network, email, and application security domains.
• Collaborate with SOC, incident response, security engineering, and technology teams to understand monitoring needs and improve security outcomes.
• Document detection logic, assumptions, data sources, tuning decisions, and investigation guidance in a clear and maintainable way.
• Support ongoing assessment of detection effectiveness, including relevance, actionability, coverage, and operational value.

Required Qualifications

• Experience in cybersecurity, security monitoring, SOC operations, incident response, threat hunting, or detection engineering.
• Hands‑on experience with Microsoft Sentinel and familiarity with the broader Microsoft security suite .
• Working knowledge of Splunk and the ability to review or support SIEM-based detections and investigations.
• Strong understanding of cybersecurity fundamentals, including common attack techniques, security controls, incident investigation, and risk‑based thinking.
• Familiarity with cloud security concepts, especially around identity, access, logging, monitoring, and misconfiguration risks.
• Understanding of security telemetry from identity, endpoint, network, email, cloud, and application environments.
• Ability to assess whether alerts are accurate, actionable, and useful for security operations.
• Strong analytical, troubleshooting, communication, and documentation skills.
• Ability to work with cross‑functional technical teams in a large enterprise environment.

Preferred Qualifications

• Experience with KQL, SPL, or other security query languages.
• Experience with Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, or Defender for Cloud Apps.
• Experience with endpoint detection and response tools such as SentinelOne or similar EDR platforms.
• Familiarity with MITRE ATT&CK, threat intelligence, attack paths, or adversary behaviour analysis.
• Exposure to detection lifecycle management, detection‑as‑code, automation, SOAR, or version‑controlled security content.
• Scripting or automation experience using Python, PowerShell, or similar technologies.
• Experience working in a regulated, financial services, or large enterprise environment.

Candidate Profile

The ideal candidate is a hands‑on cybersecurity professional who understands both security operations and detection engineering. They should be comfortable working with SIEM data, investigating suspicious activity, improving