Security Specialist - Incident Commander (DFIR)

Ubisoft; Montreal (administrative region); On-site; CAD 110,000 - 150,000; Full time

Job summary

Ubisoft Montréal is seeking a Security Specialist - Incident Commander (DFIR) to lead responses to complex cybersecurity incidents impacting global infrastructure, game production environments, and player-facing services. You’ll join the Security and Risk Management team and help strengthen our detection, investigation, and response capabilities across the organization.

You will coordinate incident management across security operations, IT, legal, and production teams; conduct proactive threat

Qualifications

• Experience responding to and coordinating cybersecurity incidents from detection through resolution.
• Ability to work independently, identify gaps, and implement improvements.
• Strong knowledge of SIEM/EDR platforms and related tools.
• Hands-on experience with digital forensic investigations.

Responsibilities

• Lead the response to high-severity cybersecurity incidents across teams (security operations, IT, legal, production).
• Coordinate incident management activities and act as central point of contact during investigations.
• Analyze security risks affecting game production environments, live services, and data.
• Improve incident response processes, procedures, and tools.
• Conduct proactive threat hunting across enterprise environments.
• Perform digital forensic investigations using Velociraptor, Autopsy, and related tools.
• Communicate findings and response plans to stakeholders; mentor team members.

Skills

Incident response

Coordination

Threat hunting

Digital forensics

Splunk

Endpoint detection

Tools

Velociraptor

Autopsy

Axiom

Job description

Company Description

Ubisoft is a global leader in gaming with teams across the world creating original and memorable gaming experiences, from Assassin’s Creed, Rainbow Six to Just Dance and more. We believe diverse perspectives help both players and teams thrive. If you’re passionate about innovation and pushing entertainment boundaries, join our journey and help create the unknown!

Company Description

Ubisoft is a global leader in gaming with teams across the world creating original and memorable gaming experiences, from Assassin’s Creed, Rainbow Six to Just Dance and more. We believe diverse perspectives help both players and teams thrive. If you’re passionate about innovation and pushing entertainment boundaries, join our journey and help create the unknown!

Job Description

As a Security Specialist - Incident Commander (DFIR) at Ubisoft Montréal, you will lead the response to complex cybersecurity incidents affecting our global infrastructure, game production environments, and player-facing services. You’ll join the Security and Risk Management team and help strengthen our detection, investigation, and response capabilities across the organization.

What You’ll Do

• Lead the response to high‑severity cybersecurity incidents across multiple teams including security operations, information technology, legal, and production teams
• Coordinate incident management activities and serve as a central point of contact during active investigations
• Analyze security risks affecting game production environments, live services, development pipelines, and player data
• Improve incident response processes, investigation procedures, and internal security tools
• Conduct proactive threat hunting activities across enterprise environments
• Perform digital forensic investigations involving memory, disk, and network analysis using tools such as Velociraptor, Autopsy, and similar platforms
• Collaborate with technical and non‑technical stakeholders to communicate investigation findings and response plans
• Mentor team members and support knowledge sharing activities across the security operations center
• Lead simulation exercises and contribute to continuous improvement initiatives
• Prepare post‑incident reports for technical teams, leadership, legal, and privacy stakeholders

Qualifications

What you bring to the team

• Experience responding to and coordinating complex cybersecurity incidents from detection through resolution
• Demonstrated ability to work independently, identify gaps, recommend improvements, and implement solutions
• Strong knowledge of security information and event management platforms and endpoint detection and response tools such as Splunk, CrowdStrike, Defender, or equivalent technologies
• Experience working with security automation and orchestration platforms
• Hands‑on experience conducting digital forensic investigations using tools such as Velociraptor, Autopsy, Axiom, or similar solutions
• Knowledge of threat hunting methodologies and investigation techniques in complex environments
• Strong communication skills with the ability to adapt technical information for different audiences
• Experience working with gaming environments, anti‑cheat systems, or large‑scale cloud services is an asset

Additional Information

• Your CV highlighting relevant skills and experiences
• Relevant project links, publications, or technical presentations related to cybersecurity or incident response