DFIR / Incident Response Specialist

Arobas Personnel; Montreal; On-site; CAD 90,000 - 130,000; Full time

Job summary

Arobas Personnel recherche un spécialiste DFIR/Incident Response expérimenté pour soutenir l’équipe DFIR dans l’analyse et la réponse aux incidents sur l’environnement client à Montréal. Le poste suppose la gestion de la chaîne de custody et la rédaction de rapports post‑incident.

Le candidat idéal mène des enquêtes rapides, effectue des analyses sur endpoints, réseau, mémoire et cloud, et collabore étroitement avec le SOC, CTI et les équipes Red Team pour améliorer les playbooks et les

Qualifications

• Expérience en investigation et réponse à des incidents de sécurité.
• Capacité à réaliser des analyses forensiques sur endpoints, réseau, mémoire et cloud.
• Établir les causes et les chronologies des incidents.
• Connaissance des procédures de chaîne de custody des preuves.
• Rédaction de rapports d’incidents et playbooks.

Responsibilities

• Enquêter et répondre aux incidents de sécurité.
• Trier et enquêter les alertes SOC en incidents confirmés.
• Réaliser des analyses forensiques sur systèmes compromis.
• Établir les vecteurs d'attaque, la chronologie et l’impact.
• Collecter et préserver les preuves selon la chaîne de custody.
• Contribuer à l’élaboration des rapports et post‑incident reviews.
• Collaborer avec SOC, CTI, Detection Engineering et Red Team.

Skills

DFIR

Incident Response

Forensic Analysis

Root Cause Analysis

SOC Collaboration

Job description

Arobas Personnel is looking for an experienced DFIR / Incident Response Specialist for a contract opportunity with one of our clients.

The specialist will support the Digital Forensics & Incident Response (DFIR) team in investigating and responding to security incidents, conducting forensic analysis, and supporting containment, eradication, and recovery activities.

Key Responsibilities

• Investigate and respond to security incidents across the organization’s environment


• Triage and investigate security alerts escalated by the SOC into confirmed incidents


• Perform digital forensic analysis on compromised or suspicious systems, including endpoint, network, memory, and cloud environments


• Establish root cause, scope, and incident timelines through forensic analysis


• Collect and preserve forensic evidence following chain‑of‑custody procedures


• Identify Indicators of Compromise (IOCs) and adversary TTPs and share findings with CTI and Detection Engineering teams


• Support containment, eradication, and recovery activities in coordination with IT and infrastructure teams


• Draft incident reports and post-incident reviews, including root cause analysis and remediation recommendations


• Contribute to and refine Incident Response playbooks and runbooks


• Collaborate with SOC, CTI, Detection Engineering, and Red Team stakeholders on incident handling and lessons learned

Key Deliverables

• Completed incident investigations with documented timelines, root cause, and impact assessments


• Forensic evidence packages, including disk, memory, network, and cloud artifacts, preserved according to chain‑of‑custody standards


• IOC and TTP reporting to support CTI and Detection Engineering improvements


• Post-incident reports including remediation and lessons-learned recommendations


• Updated and refined Incident Response playbooks and runbooks

Key Expertise

• Digital Forensics & Incident Response (DFIR)


• Security incident investigation and response


• Endpoint, network, memory, and cloud forensic analysis


• Forensic evidence collection and preservation


• IOC and TTP identification


• Incident containment, eradication, and recovery


• Incident reporting and root cause analysis

Id 10060

Emplacement Montréal

Durée De L'emploi Temps Plein

Nombre D'emplois Vacants 1

Date Limite De Dépôt

Dernière mise à jour: 26-11-04 15:25