About the role

Cybersecurity Engineer administering Microsoft Sentinel, Splunk, Google SecOps, and Cribl for TD’s enterprise security monitoring. Supporting SIEM integration, optimization, cloud logging, and L3/L4 operations.

Responsibilities

Integrate system and application security event data sources into TD enterprise SIEM platforms
Administer and maintain enterprise SIEM platforms, including upgrades, health checks, dashboards, and reports
Collaborate with data onboarding teams and stakeholders on SIEM data ingestion and security use cases
Plan strategic roadmaps for analytics technologies with security engineering and Cyber Threat Management teams
Contribute to the strategic roadmap for TD enterprise SIEM platforms
Research logging techniques for identifying, retrieving, and monitoring security events from emerging technologies
Provide L3/L4 support to L2 teams and business users
Plan and execute capacity and currency uplifts within required timelines
Promote and drive automation opportunities
Support security logging and monitoring for TD assets in public cloud
Develop skills supporting security engineering tasks related to security logging and AI security initiatives
Adhere to internal policies, technology control standards, and regulatory guidelines
Influence behavior to reduce risk and strengthen enterprise technology risk management culture

University or Post-Graduate Degree in Computer Science, Engineering, Cybersecurity, Information Systems/Technology, or a related discipline
5+ years of relevant information technology and security engineering experience
Good knowledge and administrative experience with SIEM tools, including Microsoft Sentinel
Very good knowledge of onboarding logs to SIEM
Operational experience administering an enterprise SIEM platform
Good knowledge of IT security, risk disciplines and practices, and cloud security
Specialized knowledge of business applications, systems, networks, innovation, design activities, best practices, and business standards
Strong partnership skills for collaboration across teams and lines of business
Excellent written and oral communication skills and ability to present information to technical staff and stakeholders
Ability to work collaboratively and autonomously on complex security analytics technology initiatives
Strong interest in learning new technologies within the security logging and monitoring ecosystem
Certification in at least one SIEM technology required; Microsoft Sentinel and/or Splunk preferred
Security certification required, such as CISSP, CCSP, or CompTIA Security+
Microsoft Security Operations Analyst certification is an advantage
Splunk administrator or architecture certification is beneficial
Google Cloud security certification is beneficial