Security Specialist - Incident Commander (DFIR)

Company Description

Ubisoft is a global leader in gaming with teams across the world creating original and memorable gaming experiences, from Assassin’s Creed, Rainbow Six to Just Dance and more. We believe diverse perspectives help both players and teams thrive. If you’re passionate about innovation and pushing entertainment boundaries, join our journey and help create the unknown! 

Job Description

As a Security Specialist - Incident Commander (DFIR) at Ubisoft Montréal, you will lead the response to complex cybersecurity incidents affecting our global infrastructure, game production environments, and player-facing services. You’ll join the Security and Risk Management team and help strengthen our detection, investigation, and response capabilities across the organization. 

What you’ll do 

• Lead the response to high-severity cybersecurity incidents across multiple teams including security operations, information technology, legal, and production teams 
• Coordinate incident management activities and serve as a central point of contact during active investigations 
• Analyze security risks affecting game production environments, live services, development pipelines, and player data 
• Improve incident response processes, investigation procedures, and internal security tools 
• Conduct proactive threat hunting activities across enterprise environments 
• Perform digital forensic investigations involving memory, disk, and network analysis using tools such as Velociraptor, Autopsy, and similar platforms 
• Collaborate with technical and non-technical stakeholders to communicate investigation findings and response plans 
• Mentor team members and support knowledge sharing activities across the security operations center 
• Lead simulation exercises and contribute to continuous improvement initiatives 
• Prepare post-incident reports for technical teams, leadership, legal, and privacy stakeholders 

Qualifications

What you bring to the team 

• Experience responding to and coordinating complex cybersecurity incidents from detection through resolution 
• Demonstrated ability to work independently, identify gaps, recommend improvements, and implement solutions 
• Strong knowledge of security information and event management platforms and endpoint detection and response tools such as Splunk, CrowdStrike, Defender, or equivalent technologies 
• Experience working with security automation and orchestration platforms 
• Hands-on experience conducting digital forensic investigations using tools such as Velociraptor, Autopsy, Axiom, or similar solutions 
• Knowledge of threat hunting methodologies and investigation techniques in complex environments 
• Strong communication skills with the ability to adapt technical information for different audiences 
• Experience working with gaming environments, anti-cheat systems, or large-scale cloud services is an asset 

Additional Information

• Your CV highlighting relevant skills and experiences 

• Relevant project links, publications, or technical presentations related to cybersecurity or incident response