Senior Information Security Analyst (CSIRT)

About the role

TD Securities is hiring a Senior Information Security Analyst for its Cyber Security Incident Response Team (CSIRT), which protects the Bank, its assets and reputation by supporting incidents from internal and external threats. The CSIRT is a global team running 24x7 in a follow-the-sun model, working out of TD Bank's fusion center in Singapore. Working hours are 7am to 4pm, with rotational weekend on-call coverage.

Key responsibilities

• Investigate and contribute to the triage, containment, remediation and post-incident review of complex cyber security events, escalating material risks through the right channels.
• Analyze alerts, endpoint telemetry, network traffic, logs and malware behavior to find the attack vector, persistence, lateral movement, data exfiltration, root cause and control gaps.
• Perform static and dynamic malware analysis and support active threat hunting; refine SIEM correlation logic, alerting and detection use cases based on attacker TTPs.
• Use endpoint detection and response tools to investigate suspicious activity and support containment and remediation.
• Provide clear, timely updates, risk assessments and recommendations to partners, technology teams, business stakeholders and executives, and document findings and lessons learned.
• Take part in rotational weekend on-call coverage and support the global follow-the-sun model.

Required profile

• Demonstrated experience investigating security incidents and complex alerts in an enterprise environment.
• Strong analytical and problem-solving skills, and excellent written and verbal communication, able to explain technical risk in business terms.
• Organization and case-management discipline, with the ability to handle multiple priorities and keep clear documentation.
• Willingness to take part in rotational weekend on-call coverage.
• Preferred: hands-on cloud security monitoring, digital forensics and malware analysis tools, a recognized cyber security certification (e.g. SANS, ISC2), and prior experience in financial services or another highly regulated environment.

Required skills

• Static and dynamic malware analysis.
• SIEM-based detection use cases, correlation logic and alert generation.
• Enterprise-grade endpoint detection and response solutions.
• Security alert analysis, incident and event management, log and network traffic analysis, and applying AI-led automation and SOAR to incident response.

What we offer

• A total rewards package including a base salary, health and well-being benefits, medical coverage, paid time off, career development and reward and recognition programs.
• Regular development conversations, training programs, an online learning platform and mentoring programs.
• Training and onboarding sessions for the new role.