Cloud Security Specialist – Detection Engineering

Ubisoft Entertainment; Saint-Mandé; Sur place; EUR 90 000 - 140 000; Plein temps

Avantages offerts par ce poste

Profit Sharing, yearly company saving 

25 days paid time off + 12 additional

Transport pass assistance 50%

Lunch vouchers 9€/day

Healthcare for you and your family

Résumé du poste

Ubisoft Entertainment, a global leader in gaming, is seeking a Cloud Security Specialist to join the Detection Engineering team within the SOC. You will design, build, and tune detection content for cloud infrastructure, CI/CD pipelines, and DevOps tooling, focusing on real-world attack scenarios and automation.

Training and mentoring are provided to grow detection engineering expertise. You will leverage cloud security fundamentals, CI/CD security knowledge, and emerging GenAI techniques to

Qualifications

• Hands-on experience operating, building, or securing public cloud environments (AWS, Azure, or GCP).
• Strong knowledge of CI/CD pipelines and how they get attacked.
• Familiarity with infrastructure-as-code and cloud-native logging/telemetry.
• Scripting ability to build detection logic and automate analysis.
• Solid grasp of IAM, network segmentation, container/Kubernetes security.
• Interest in applying LLMs/GenAI to security use cases.

Responsabilités

• Develop and maintain detection content (Splunk/SIEM, cloud-native logging, IDS) targeting cloud infrastructure, IAM, containers/Kubernetes, and CI/CD pipelines.
• Define detection engineering processes and standards for cloud and DevOps attack surfaces.
• Conduct threat hunting across cloud environments and CI/CD telemetry.
• Translate attacker TTPs into detection logic (MITRE ATT&CK for Cloud, etc.).
• Leverage LLMs and GenAI to accelerate detection engineering and alert enrichment.
• Design and build automated response playbooks that contain cloud/CI-CD threats.
• Validate detection coverage through purple-teaming and adversary emulation.
• Mentor SOC analysts on cloud-related alerts and data sources.
• Work with CTI/IR to convert cloud threat intel into detections and automation.
• Identify logging/telemetry gaps and drive requirements to platform teams.

Connaissances

Cloud security experience

CI/CD security

IaC & cloud telemetry

Scripting (Python/Go)

Cloud security fundamentals

GenAI/LLMs in security

SOAR/automation

Threat detection mindset

Cloud security certs asset

Outils

Splunk

GitHub Actions

Jenkins

Terraform

CloudFormation

Description du poste

Cloud Security Specialist – Detection Engineering

Ubisoft is a global leader in gaming with teams across the world creating original and memorable gaming experiences, from Assassin’s Creed, Rainbow Six, to Just Dance and more. We believe diverse perspectives help both players and teams thrive. If you’re passionate about innovation and pushing entertainment boundaries, join our journey and help us create the unknown!

JOB DESCRIPTION

As a Cloud Security Specialist joining Ubisoft's Detection Engineering team within the SOC, you design, build, and tune the detection content that catches attacks against Ubisoft's cloud infrastructure, CI/CD pipelines, and DevOps tooling. Your value comes from deep, hands‑on knowledge of how cloud environments and pipelines actually work — gained as a cloud, DevOps, or CI/CD engineer — which you will apply, with dedicated mentoring and training, to detection engineering methodology, SIEM content development, and threat hunting. You are not securing or building cloud infrastructure in this role: you are hunting and detecting the attackers who target it, and increasingly, using LLMs and GenAI to do it faster and building the automation that responds once a threat is confirmed.

Responsibilities

• Develop and maintain detection content (Splunk/SIEM, cloud‑native logging, IDS) targeting attacks against cloud infrastructure, IAM, containers/Kubernetes, and CI/CD pipelines;


• Define detection engineering processes and standards specific to cloud and DevOps attack surfaces;


• Conduct threat hunting engagements across cloud environments and CI/CD telemetry;


• Research attacker TTPs targeting cloud and CI/CD (MITRE ATT&CK for Cloud, supply chain attacks, IAM abuse, container escape, pipeline poisoning) and translate them into detection logic;


• Leverage LLMs and GenAI to accelerate detection engineering work — generating and tuning detection logic, summarizing and enriching alerts, and speeding up hunting and triage;


• Design and build automated response playbooks (SOAR or custom orchestration) that contain or remediate cloud/CI-CD threats without manual intervention;


• Validate detection coverage through purple‑teaming and adversary emulation against cloud environments;


• Mentor SOC analysts on investigating cloud-related alerts and the data sources available to them;


• Work with CTI and Incident Response to convert cloud threat intelligence into new detections and response automation;


• Identify logging and telemetry gaps in cloud/CI-CD systems that limit detection coverage, and drive requirements back to platform teams.

QUALIFICATIONS

• Significant hands‑on experience operating, building, or securing public cloud environments (AWS, Azure, or GCP) as a cloud engineer, DevOps engineer, SRE, or cloud security specialist;


• Solid understanding of CI/CD pipelines and tooling (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, etc.) and how they get attacked;


• Familiarity with infrastructure‑as‑code (Terraform, CloudFormation, Pulumi) and cloud‑native logging/telemetry (CloudTrail, Azure Activity Log, GCP Audit Logs, etc.);


• Scripting ability (Python, Go, or similar) to build detection logic and automate analysis and response;


• Solid grasp of cloud security fundamentals: IAM, network segmentation, container/Kubernetes security, secrets management;


• Experience or strong interest in applying LLMs/GenAI to security use cases (prompt engineering, RAG, agentic workflows) is a significant asset;


• Experience building security automation or orchestration (SOAR platforms, custom workflow engines, scripted response) is a plus;


• No prior SOC or detection engineering experience required — what matters is a strong analytical mindset and genuine interest in threat detection; you will be trained on Splunk content development, threat hunting methodology, and detection engineering practice;


• Cloud or security certification is an asset (AWS/Azure/GCP security specialty, CKS, GCDA, or equivalent).

ADDITIONAL INFORMATION

Ubisoft's perks

• Profit Sharing, yearly company saving plan.


• 25 paid time off + 12 additional paid days off.


• 50% of your transportation pass is paid by the company, lunch vouchers (9€/day), healthcare for you and your family, and lots of Ubisoft additional perks.


• Maternity leaves of 20 weeks, paternity/co-parental leaves of 7 weeks.


• Our office is located in Saint Mandé, (Metro line 1, Saint Mandé station).

Information about Ubisoft

Ubisoft offers the same job opportunities to all, without any distinction of gender, ethnicity, religion, sexual orientation, social status, disability, or age. Ubisoft ensures the development of an inclusive work environment which mirrors the diversity of our gamers’ community.

I am not familiar with the video game industry. Would I fit into Ubisoft?

At Ubisoft, everyone is welcome! We know that by bringing together different perspectives and experiences, we create a more inclusive environment for our team members. You’ll get the chance to work with teams and projects that inspire and challenge you every single day.