Information Security Analyst

Work Location: Mississauga, Ontario, Canada Hours: 37.5 Line of Business: Technology Solutions Pay Details: $81,600 - $115,200

Cad Td

is committed to providing fair and equitable compensation opportunities to all colleagues. Growth opportunities and skill development are defining features of the colleague experience at TD. Our compensation policies and practices have been designed to allow colleagues to progress through the salary range over time as they progress in their role. The base pay actually offered may vary based upon the candidate's skills and experience, job-related knowledge, geographic location, and other specific business and organizational needs. As a candidate, you are encouraged to ask compensation related questions and have an open dialogue with your recruiter who can provide you more specific details for this role. Job Description: Job Description Summary Define, develop, and implement Technology Controls and Information Security-related policies, programs, standards, processes, and tools. Provide specialized expertise and guidance on assessing risks, identifying control gaps, and developing appropriate solutions to mitigate risk and protect the Bank. The role provides subject matter expertise for the Bank’s End-User Computing governance program, including asset classification, attestation, risk and control assessments, thematic remediation, high-risk mitigation, standards enhancement, stakeholder guidance, governance reporting, learning content, and intake management. The role may participate in projects of moderate to high complexity and provide complex reporting, analysis, and assessments at the functional, business-line, or enterprise level. Job Description

Key Accountabilities

• Provide consultation and advice to business, technology, and control partners on End-User Computing governance, information security requirements, policies, standards, processes, and controls.
• Serve as an EUC risk and technology subject matter expert, helping stakeholders understand asset classification, registration, attestation, risk assessment, control, and remediation requirements.
• Conduct or support Inherent Risk Assessments and Control Gap Assessments, document identified risks and control gaps, and provide practical guidance on remediation strategies.
• Coordinate the intake, review, prioritization, and assignment of EUC-related requests, ensuring stakeholders receive timely and consistent guidance.
• Develop and maintain EUC governance content, guidance, procedures, learning materials, and knowledge resources through approved collaboration platforms.
• Lead or support stakeholder engagement sessions, office hours, and knowledge-sharing activities to promote understanding and consistent application of EUC requirements.
• Establish effective relationships across business, technology, program, project, and control functions to support risk-based decision-making and timely issue resolution.
• Maintain the integrity and quality of the EUC Book of Record through asset classification, attestation campaigns, ongoing monitoring, data-quality reviews, and assessment of asset changes and risk indicators.
• Lead or contribute to risk and control design assessments, clearly documenting the impact of control gaps on the business and the Bank and supporting the development of risk-mitigation and remediation plans.
• Support thematic analysis and remediation activities by identifying common risk patterns, determining affected populations, tracking corrective actions, and escalating material issues where required.
• Support mitigation of Functionally High-Risk EUC assets and EUC assets subject to Payment Card Industry requirements, including risk identification, control-gap analysis, action tracking, stakeholder engagement, and management reporting.
• Contribute to the definition, review, enhancement, and implementation of EUC security standards, controls, procedures, and supporting governance processes.
• Develop ongoing EUC risk reporting and monitor Key Performance Indicators and Key Risk Indicators to measure program performance, risk exposure, remediation progress, and control effectiveness.
• Perform or support quality assurance and quality control reviews to promote the accuracy, completeness, and consistency of EUC classifications, assessments, control determinations, and reporting.
• Provide support and consultation for internal audits, regulatory examinations, compliance reviews, and management responses, including the coordination and tracking of remediation activities.
• Consult on regulatory and compliance requirements, reporting, and information requests related to EUC governance.
• Monitor emerging technology, security, regulatory, and industry developments and assess their potential impact on the Bank’s EUC governance and control environment.
• Identify key risks and issues and escalate them to the appropriate stakeholders and levels of management.
• Adhere to and support the oversight, monitoring, and enforcement of enterprise frameworks, methodologies, policies, procedures, technology-control standards, and applicable regulatory guidelines.
• Maintain a strong culture of risk management and control supported by effective processes, sound governance, and alignment with the Bank’s risk appetite.
• Continuously enhance knowledge and expertise in EUC governance, technology risk, information security, regulatory requirements, and industry practices.
• Prioritize and manage individual workload to deliver accurate, high-quality results within assigned timelines.
• Support a positive work environment that promotes service, quality, innovation, inclusion, collaboration, and teamwork.
• Communicate issues, risks, dependencies, and points of interest to team members and stakeholders in a timely manner.
• Identify and recommend opportunities to improve productivity, control effectiveness, stakeholder experience, and operational efficiency.
• Participate in knowledge transfer, documentation, training, and learning activities within the team and across supported business areas.
• Contribute specialized expertise to business-specific, cross-functional, and enterprise initiatives.
• Influence stakeholder behaviour to reduce risk and promote a strong technology risk management culture throughout the organization. BREADTH & DEPTH
• Advanced knowledge of one or more technology-control, information-security, risk-management, or governance domains, disciplines, and practices.
• Strong understanding of technology risk, control design, risk assessment, issue management, remediation, and governance reporting.
• Ability to analyze complex information, identify risk themes and control gaps, and communicate findings and recommendations clearly.
• Ability to interpret and apply policies, standards, control requirements, and regulatory expectations within a business and technology environment.
• Ability to work independently as an individual contributor while collaborating effectively across business, technology, risk, compliance, audit, and control functions.
• May participate in projects and initiatives of moderate to high complexity.
• Acts as a key resource and subject matter expert within a specialized technology, information security, or governance area.
• May develop or contribute to complex reporting, analysis, assessments, procedures, standards, and management presentations at the functional, business-line, or enterprise level.
• Generally reports to a Manager or Senior Manager. EXPERIENCE & EDUCATION Required:
• University degree or equivalent relevant education and professional experience.
• Experience in information security, technology risk, governance, risk assessment, control assessment, or a related discipline.
• Experience conducting risk assessments, analyzing control gaps, documenting risk impacts, and supporting remediation activities.
• Strong stakeholder consultation, analytical, written communication, and presentation skil