Hunt for TTPs, threats, risks, and vulnerabilities aligned to the MITRE ATT&CK framework using internal and external intelligence dataIdentify threats, risks, and security control gaps and produce detection and mitigation recommendations to reduce the bank's attack surfaceParticipate in proactive attack surface reduction operations across enterprise and cloud environmentsUse threat intelligence, anomalous log analysis, and brainstorming-session results to detect and mitigate threatsDevelop methodologies to identify adversary tools, techniques, and proceduresProduce metrics and dashboards identifying potential threats, suspicious or anomalous activity, and malwareTune detection infrastructure with technology teams to identify emerging threatsDocument best practices for hunting playbooks, procedures, and courses of actionServe as a subject matter expert in host-based and network-based hunting analysisCollaborate with intelligence, SOC, incident response, and security engineering teamsReview internal processes and activities and identify improvement opportunitiesInfluence behavior to reduce risk and strengthen the enterprise information security cultureMonitor emerging issues, industry trends, and relevant changes to the security landscapeRequirementsBachelor's degree in an IT/cyber-related field or equivalent experienceAt least 7+ years of cybersecurity experience3+ years of experience in malware reverse engineering, threat hunting, DFIR, threat detection, or threat intelligence preferredExpert knowledge of log management, security analytics, and SIEM platform mechanicsExperience with SIEM, SOAR, EDR, cloud-native tools, and other cybersecurity toolsetsAdvanced knowledge of Endpoint and Identity/IAM architectures, operations, and investigationsProficiency with Splunk ES, CrowdStrike, Logscale, Defender for Endpoint (MDE), MS Sentinel, and Wiz DefendHands-on experience with Netskope, Akamai, AppOmni,



Qualys, and Symantec DLP is optional/positive to haveDeep understanding of coding, scripting, and APIs for investigations, automation, and integrationsAbility to identify and generate detection logicExperience writing and implementing complex analytics queries, threat visualization dashboards, and large-volume data analysis using tools such as Splunk, Logscale, KQL, and syslogStrong knowledge of network protocols, ports, and common services including TCP/IP, HTTP/S, DNS, FTP, SMTP, and Active DirectoryExtensive knowledge of Windows, Mac, and Linux endpoints, operating systems, services, file systems, and agentsExcellent written and oral communication skillsOrganizational and self-directing skillsAbility to initiate, coordinate, prioritize, and complete responsibilities with minimal supervisionIdeal/preferred candidates have at least two certifications from the listed general cyber, endpoint/forensic, cloud, penetration-testing, or coding/scripting/SIEM certificationsCore CompetenciesDemonstrates expertise in threat hunting, risk assessment, and security control gap analysis, utilizing the MITRE ATT&CK framework and advanced cybersecurity tools. Proficient in developing detection methodologies, producing metrics, and collaborating with cross-functional teams to enhance the security posture of the organization.Highest-signal resume keywordsThreat HuntingMalware Reverse EngineeringSIEM Platform MechanicsSplunk ESEndpoint SecurityATS Optimization KeywordsHard SkillsThreat DetectionLog ManagementSecurity AnalyticsCodingScriptingAPIsComplex Analytics QueriesData AnalysisNetwork ProtocolsOperating SystemsSoft SkillsExcellent Communication SkillsOrganizational SkillsSelf-Directing SkillsIndustry KeywordsCybersecurityThreat IntelligenceIncident ResponseCloud SecurityForensicsTools & TechnologiesSIEMSOAREDRSplunkCrowdStrikeLogscaleDefender for EndpointMS SentinelWiz DefendNetskope #J-18808-Ljbffr

📌 Information Security Specialist – Attack Surface Reduction (Toronto)
🏢 Jobtailor
📍 Toronto