Security Specialist - Incident Commander (DFIR)

Ubisoft•Montreal, QC

1d•Onsite

About The Position

As a Security Specialist - Incident Commander (DFIR) at Ubisoft Montréal, you will lead the response to complex cybersecurity incidents affecting our global infrastructure, game production environments, and player-facing services. You’ll join the Security and Risk Management team and help strengthen our detection, investigation, and response capabilities across the organization.

Requirements

Experience responding to and coordinating complex cybersecurity incidents from detection through resolution
Demonstrated ability to work independently, identify gaps, recommend improvements, and implement solutions
Strong knowledge of security information and event management platforms and endpoint detection and response tools such as Splunk, CrowdStrike, Defender, or equivalent technologies
Experience working with security automation and orchestration platforms
Hands-on experience conducting digital forensic investigations using tools such as Velociraptor, Autopsy, Axiom, or similar solutions
Knowledge of threat hunting methodologies and investigation techniques in complex environments
Strong communication skills with the ability to adapt technical information for different audiences

Nice To Haves

Experience working with gaming environments, anti-cheat systems, or large-scale cloud services is an asset

Responsibilities

Lead the response to high-severity cybersecurity incidents across multiple teams including security operations, information technology, legal, and production teams
Coordinate incident management activities and serve as a central point of contact during active investigations
Analyze security risks affecting game production environments, live services, development pipelines, and player data
Improve incident response processes, investigation procedures, and internal security tools
Conduct proactive threat hunting activities across enterprise environments
Perform digital forensic investigations involving memory, disk, and network analysis using tools such as Velociraptor, Autopsy, and similar platforms
Collaborate with technical and non-technical stakeholders to communicate investigation findings and response plans
Mentor team members and support knowledge sharing activities across the security operations center
Lead simulation exercises and contribute to continuous improvement initiatives
Prepare post-incident reports for technical teams, leadership, legal, and privacy stakeholders