{"id":3553427,"url":"https://alion.io/job/td-bank-group-senior-information-security-analyst-detection-engineering","title":"Senior Information Security Analyst - Detection Engineering","company":{"id":3167,"name":"TD Bank Group","domain":"td.com","url":"https://alion.io/company/td-bank","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":99,"open_postings":761,"ghost_share":0.004,"stale_share":0.193,"repost_share":0.032,"time_to_fill_p50_days":13,"computed_at":"2026-11-05T05:54:30Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Toronto, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":69000,"max_usd":130000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":53},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Microsoft Defender for Cloud","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"SentinelOne","optional":true}],"status":"live","first_seen_at":"2026-10-30T23:42:34Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-05T09:49:24Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"Work Location:\nToronto, Ontario, CanadaHours:\n37.5Line of Business:\nTechnology SolutionsPay Details:\n$81,600 - $115,200 CADTD is committed to providing fair and equitable compensation opportunities to all colleagues. Growth opportunities and skill development are defining features of the colleague experience at TD. Our compensation policies and practices have been designed to allow colleagues to progress through the salary range over time as they progress in their role. The base pay actually offered may vary based upon the candidate's skills and experience, job-related knowledge, geographic location, and other specific business and organizational needs.\nAs a candidate, you are encouraged to ask compensation related questions and have an open dialogue with your recruiter who can provide you more specific details for this role.\nJob Description:\nJob Description\nWe are seeking a Senior Information Security Analyst to support enterprise cybersecurity monitoring, detection engineering, and security operations improvement. This role will help develop and maintain effective security detections, improve alert quality, support threat detection activities, and contribute to the overall maturity of security monitoring capabilities.\nThe successful candidate should have a strong cybersecurity foundation, practical experience with SIEM platforms, and familiarity with cloud, identity, endpoint, and network security concepts. The role requires hands-on experience with Microsoft Sentinel and the Microsoft security ecosystem, along with working knowledge of Splunk. The candidate should be able to analyze security events, understand attack behaviours, tune detections, and work with operational teams to improve detection coverage and investigation outcomes.\nKey Responsibilities\nSupport the development, review, tuning, and maintenance of security detections across SIEM and security monitoring platforms.\nAnalyze security events, alerts, and telemetry to identify suspicious activity, detection gaps, and opportunities for improvement.\nApply detection engineering principles to improve alert fidelity, reduce unnecessary noise, and ensure detections are practical for security operations.\nWork with Microsoft Sentinel, Microsoft Defender products, Microsoft Entra ID, and related security tools to support threat detection and investigation use cases.\nUse Splunk to review security data, support investigations, and assist with detection tuning where required.\nApply cybersecurity knowledge across identity, endpoint, cloud, network, email, and application security domains.\nCollaborate with SOC, incident response, security engineering, and technology teams to understand monitoring needs and improve security outcomes.\nDocument detection logic, assumptions, data sources, tuning decisions, and investigation guidance in a clear and maintainable way.\nSupport ongoing assessment of detection effectiveness, including relevance, actionability, coverage, and operational value.\nRequired Qualifications\nExperience in cybersecurity, security monitoring, SOC operations, incident response, threat hunting, or detection engineering.\nHands-on experience with Microsoft Sentinel and familiarity with the broader Microsoft security suite.\nWorking knowledge of Splunk and the ability to review or support SIEM-based detections and investigations.\nStrong understanding of cybersecurity fundamentals, including common attack techniques, security controls, incident investigation, and risk-based thinking.\nFamiliarity with cloud security concepts, especially around identity, access, logging, monitoring, and misconfiguration risks.\nUnderstanding of security telemetry from identity, endpoint, network, email, cloud, and application environments.\nAbility to assess whether alerts are accurate, actionable, and useful for security operations.\nStrong analytical, troubleshooting, communication, and documentation skills.\nAbility to work with cross-functional technical teams in a large enterprise environment.\nPreferred Qualifications\nExperience with KQL, SPL, or other security query languages.\nExperience with Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, or Defender for Cloud Apps.\nExperience with endpoint detection and response tools such as SentinelOne or similar EDR platforms.\nFamiliarity with MITRE ATT&CK, threat intelligence, attack paths, or adversary behaviour analysis.\nExposure to detection lifecycle management, detection-as-code, automation, SOAR, or version-controlled security content.\nScripting or automation experience using Python, PowerShell, or similar technologies.\nExperience working in a regulated, financial services, or large enterprise environment.\nCandidate Profile\nThe ideal candidate is a hands-on cybersecurity professional who understands both security operations and detection engineering. They should be comfortable working with SIEM data, investigating suspicious activity, improving detection quality, and applying broad cybersecurity knowledge across cloud, identity, endpoint, network, and application environments.\nThey do not need to be an expert in every tool, but they should have strong fundamentals, be able to learn quickly, think critically, and make practical decisions that improve security monitoring effectiveness.\nWho We Are:\nTD is one of the world's leading global financial institutions and is the fifth largest bank in North America by branches/stores. Every day, we strive to make every interaction, product, and experience remarkably human and refreshingly simple for over 27 million households and businesses in Canada, the United States and around the world. More than 95,000 TD colleagues bring their skills, talent, and creativity to foster deeper relationships, ensure disciplined execution, and build a simpler, faster banking experience. TD is deeply committed to being a leader in client experience, that is why we believe that all colleagues, no matter where they work, are client facing. Together, we are reimagining what banking can be for our clients, colleagues and communities.\nOur Total Rewards Package\nOur Total Rewards package reflects the investments we make in our colleagues to help them and their families achieve their financial, physical, and mental well-being goals. Total Rewards at TD includes a base salary, variable compensation, and several other key plans such as health and well-being benefits, savings and retirement programs, paid time off, banking benefits and discounts, career development, and reward and recognition programs. Learn more\nAdditional Information:\nWe’re delighted that you’re considering building a career with TD. Through regular development conversations, training programs, and a competitive benefits plan, we’re committed to providing the support our colleagues need to thrive both at work and at home.\nPlease be advised that this job opportunity is subject to provincial regulation for employment purposes. It is imperative to acknowledge that each province or territory within the jurisdiction of Canada may have its own set of regulations, requirements.\nColleague Development\nIf you’re interested in a specific career path or are looking to build certain skills, we want to help you succeed. You’ll have regular career, development, and performance conversations with your manager, as well as access to an online learning platform and a variety of mentoring programs to help you unlock future opportunities.\nIf you’re passionate about helping clients and building deep, lasting relationships, TD offers diverse career paths where you can grow your expertise and make a meaningful impact.\nWe're committed to your success and foster a respectful workplace where diverse perspectives are valued, everyone has fair opportunities to grow, and you can unlock your full potential to achieve your career goals. Here at TD, we hire and develop the best.\nTraining & Onboarding\nWe will provide training and onboarding sessions to ensure that you’ve got everything you need to succeed in your new role.\nInterview Process\nWe’ll reach out to candidates of interest to schedule an interview. We do our best to communicate outcomes to all applicants by email or phone call.\n Accommodation\nYour accessibility is important to us. Please let us know if you’d like accommodations (including accessible meeting rooms, captioning for virtual interviews, etc.) to help us remove barriers so that you can participate throughout the interview process.\nWe look forward to hearing from you!\nLanguage Requirement (Quebec only):\nSans Objet","description_format":"text","description_chars":8591,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Growth opportunities","Mentoring programs"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Commercial & Retail Banks","Security Operations","Investment Banking & M&A Advisory","Online Brokerage & Trading Platforms"],"lifecycle":[{"event":"open","at":"2026-10-30T23:42:34Z"}],"visa":[],"liveness":{"score":81,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.9,"p_room":0.9,"age_days":5,"expected_fill_days":13,"reasons":["conf:2","velocity","win:mid","comp:brand"],"computed_at":"2026-11-05T05:54:30Z"},"pay":null,"html_url":"https://alion.io/job/td-bank-group-senior-information-security-analyst-detection-engineering","json_url":"https://alion.io/job/td-bank-group-senior-information-security-analyst-detection-engineering.json","meta":{"generated_at":"2026-11-05T12:18:02Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15898,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3167},"rest":"https://alion.io/mcp/rest/get_company?id=3167"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftd-bank-group-senior-information-security-analyst-detection-engineering"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftd-bank-group-senior-information-security-analyst-detection-engineering"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftd-bank-group-senior-information-security-analyst-detection-engineering"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/td-bank-group-senior-information-security-analyst-detection-engineering\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftd-bank-group-senior-information-security-analyst-detection-engineering"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3553427}},{"tool":"search_jobs","arguments":{"company":"td.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3553427},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}