Senior Information Security Analyst - Detection Engineering

Description

The security operations team needs a senior analyst to help monitor the enterprise, build and upkeep detections, and make the monitoring program more mature.

You will bring a solid security background, hands-on SIEM work, and grounding in cloud, identity, endpoint and network security. Microsoft Sentinel experience is required, along with working knowledge of Splunk. The job centres on reading security events, understanding how attacks unfold, tuning detections, and working with operations staff to widen coverage and improve investigations.

The company is one of the largest banks in the world and the fifth largest in North America by branches. It serves more than 27 million households and businesses in Canada, the United States and elsewhere, and employs over 95,000 colleagues.

The right person is hands-on and understands both security operations and detection engineering. Deep expertise in every tool matters less than strong fundamentals, quick learning, critical thinking and practical decisions that make monitoring more effective.

Responsibilities

• Help build, review, tune and maintain detections across SIEM and monitoring platforms.
• Go through events, alerts and telemetry to spot suspicious activity and gaps in coverage.
• Apply detection engineering practice to raise alert quality, cut needless noise, and keep detections workable for SOC staff.
• Use Microsoft Sentinel, Defender products, Microsoft Entra ID and related tools for detection and investigation work.
• Query Splunk to review security data, support investigations, and tune detections when needed.
• Bring security knowledge to identity, endpoint, cloud, network, email and application areas.
• Work with SOC, incident response, security engineering and technology teams to meet monitoring needs.
• Write clear, maintainable documentation covering detection logic, assumptions, data sources, tuning choices and investigation steps.
• Regularly assess how well detections perform on relevance, actionability, coverage and operational value.

Requirements

• Background in cybersecurity, security monitoring, SOC work, incident response, threat hunting or detection engineering.
• Hands-on Microsoft Sentinel experience and familiarity with the wider Microsoft security suite.
• Working knowledge of Splunk, enough to review or support SIEM detections and investigations.
• Solid grasp of security fundamentals, including common attack techniques, controls, incident investigation and risk-based thinking.
• Understanding of cloud security, particularly identity, access, logging, monitoring and misconfiguration risk.
• Knowledge of security telemetry from identity, endpoint, network, email, cloud and application systems.
• Skill in judging whether alerts are accurate, actionable and useful to security operations.
• Strong analysis, troubleshooting, communication and documentation skills.
• Ability to work with cross-functional technical teams in a large enterprise.
• Preferred: experience with KQL, SPL or other security query languages.
• Preferred: experience with Microsoft Defender XDR or the Defender for Endpoint, Identity, Office 365, Cloud or Cloud Apps products.
• Preferred: experience with SentinelOne or similar EDR platforms.
• Preferred: familiarity with MITRE ATT&CK, threat intelligence, attack paths or adversary behaviour analysis.
• Preferred: exposure to detection lifecycle management, detection-as-code, automation, SOAR or version-controlled security content.
• Preferred: scripting or automation with Python, PowerShell or similar technologies.
• Preferred: experience in a regulated, financial services or large enterprise setting.

Conditions

Location: Toronto, Ontario, Canada.

Hours field listed as 5.

Line of business: Technology Solutions.

Base salary range: $81,600 to $115,200 CAD.

Pay offered may depend on skills, experience, job knowledge, location and business needs, and the recruiter can answer pay questions in detail.

Pay progresses through the range over time as you grow in the role.

Provincial employment rules may apply, and each province or territory may have its own requirements.

Benefits

• Total rewards include base pay, variable pay, health and well-being coverage, savings and retirement plans, paid time off, banking perks and discounts, career development, and recognition programs.
• Regular career, development and performance conversations with your manager.
• Access to an online learning platform and mentoring programs.
• Training and onboarding sessions to prepare you for the role.