Information Security Specialist - Penetration Testing
Building a World-Class Technology Team at TD
We can’t afford to be boring. Neither can you. The scale and scope of what TD does may surprise you. The rapid pace of change makes it a business imperative for us to be smart and open-minded in the way we think about technology. TD’s technology and business teams become more intertwined as new opportunities present themselves. This new era in banking does not equal boring. Not at TD, anyway.
TD Information Security covers the development and management of security strategies, policies and programs to assess, prioritize, and mitigate business risk with technology controls. Priorities include: mitigating and managing cybersecuritythreats, ensuring systems availability, aligning with global regulatory risk and compliance requirements, managing systems and network complexity, and partnering with businesses for better technology delivery by providing advice on technology controls.
There’s room to grow in all of it.
About This Role
We are looking for someone to develop and implement Technology Controls and Information Security related policies, programs and tools. You will provide specialized expertise and guidance on assessing risks, identifying potential gaps and providing security solutions to mitigate risks and protect TD. You may also participate on projects of moderate to high complexity and provide complex reporting, analysis, and assessments at the functional, business line or enterprise level.
Meaningful work is fueled by meaningful performance and career development conversations with your manager. Here are the essential job functions of this position:
- Performs thorough penetration testing that includes the identification, reporting, and recommendations for security vulnerabilities while adhering to management driven scope and deadlines
- Identifies, proves, and reports vulnerabilities that cannot be identified by scanners or tools
- Reviews and identifies false positives generated by scanners or tools
- Stays up to date on the latest exploits and security trends
- Delivers clear and coherent written reporting and remediation guidance
- Ensure technology, processes, and governance are in place to monitor, detect, prevent, and react to both current and emerging technology and securitythreats against TDBG’s business.
- Develop on-going technologyriskreporting, monitoring key trends and defining metrics to regularly measure control effectiveness for own area.
- Adhere to internal policies and procedures, technology control standards, and applicable regulatory guidelines.
- Contribute to the review of internal processes and activities and assist in identifying potential opportunities for improvement.
- Adhere to, advise, oversee, monitor and enforce enterprise frameworks and methodologies that relate to technology controls / information security activities.
- Influence behavior to reduce risk and foster a strong technologyrisk management culture throughout the enterprise .
Other duties as assigned
• Driving Requirements: minimal, as needed
• Travel Requirements: minimal, as needed
What can you bring to TD?Share your credentials, but your relevant experience and knowledge can be just as likely to get our attention. Here are the minimum requirements for this position:
- University Degree.
- Information Security Certification / Accreditation an asset.
- 7+ years of relevant experience.
- Expert knowledge of IT security and risk disciplines and practices.
- Advanced knowledge of of organization, technology controls, security and risk issues.
- Demonstrated ability to participate in complex, comprehensive or large projects and initiatives.
- Ability to serve as a lead expert resource in technology controls and information security for project teams, the business, organization and outside vendors.
PreferredQualifications – Here are thepreferredqualifications for this role:
- 5+ years of experience in security applications and systems preferred
- 5years of demonstrated experience with automated and manual penetration tools preferred
- Demonstrated experience with creating and communication of reports regarding web application vulnerabilities to various level of personnel within a large organization preferred
- Preferred Certifications: GIAC Web Application Penetration Tester (GWAPT), GIAC Penetration Tester (GPEN), Certified Ethical Hacker (CEH) or Offensive Security Certified Professional (OSCP)