Security Analyst - Dfir

Job Description

Ubisoft is a global leader in gaming with teams across the world creating original and memorable gaming experiences, from Assassin's Creed, Rainbow Six to Just Dance and more. We believe diverse perspectives help both players and teams thrive. If you're passionate about innovation and pushing entertainment boundaries, join our journey and help create the unknown!
Job Description
As a Security Analyst – DFIR at Ubisoft Montréal, you will join the Security and Risk Management team within Ubisoft IT. In this Security Analyst – DFIR role, you will help protect Ubisoft by leading digital forensics and incident response activities, coordinating stakeholders, and strengthening our security posture through threat hunting, automation, and prevention. As a Security Analyst – DFIR, you will work closely with technical teams and leadership to manage incidents from detection through resolution.
What you'll do
• Lead incident response activities before, during, and after security incidents
• Act as the central point of contact during incidents across Ubisoft teams
• Coordinate and delegate actions with cross-functional stakeholders
• Produce and communicate post-incident reports and recommendations
• Guide internal investigations in line with established security policies
• Support threat hunting, malware analysis, and digital forensics activities
• Contribute to automated response workflows and vulnerability response
• Prepare and run incident scenarios and tabletop exercises with teams
Qualifications
What you bring to the team
• Hands-on expertise in digital forensics and incident response (DFIR)
• Practical experience with SIEM tools, such as Splunk
• Familiarity with endpoint protection, including AV and EDR solutions
• Knowledge of forensics and investigation tools such as Velociraptor, Autopsy, or Axiom
• Ability to translate technical findings into clear messages for non-technical partners
• Strong collaboration skills when working with legal, compliance, and privacy teams
• Understanding of threat intelligence and incident prevention practices
• Relevant cybersecurity certifications considered an asset

Jobcode: Reference SBJ-mkx8om-18-97-14-87-42 in your application.