DFIR / Incident Response Specialist
- Montreal, QC, Canada
Full-time
Applications open in a new tab.
Job details
- Job type
- Full-time
- Apply by
- Posting language
- English
- Posted
Original job description
Arobas Personnel is looking for an experienced DFIR / Incident Response Specialist for a contract opportunity with one of our clients.
The specialist will support the Digital Forensics & Incident Response (DFIR) team in investigating and responding to security incidents, conducting forensic analysis, and supporting containment, eradication, and recovery activities.
Key Responsibilities
🔹 Investigate and respond to security incidents across the organization’s environment
🔹 Triage and investigate security alerts escalated by the SOC into confirmed incidents
🔹 Perform digital forensic analysis on compromised or suspicious systems, including endpoint, network, memory, and cloud environments
🔹 Establish root cause, scope, and incident timelines through forensic analysis
🔹 Collect and preserve forensic evidence following chain-of-custody procedures
🔹 Identify Indicators of Compromise (IOCs) and adversary TTPs and share findings with CTI and Detection Engineering teams
🔹 Support containment, eradication, and recovery activities in coordination with IT and infrastructure teams
🔹 Draft incident reports and post-incident reviews, including root cause analysis and remediation recommendations
🔹 Contribute to and refine Incident Response playbooks and runbooks
🔹 Collaborate with SOC, CTI, Detection Engineering, and Red Team stakeholders on incident handling and lessons learned
Key Deliverables
🔹 Completed incident investigations with documented timelines, root cause, and impact assessments
🔹 Forensic evidence packages, including disk, memory, network, and cloud artifacts, preserved according to chain-of-custody standards
🔹 IOC and TTP reporting to support CTI and Detection Engineering improvements
🔹 Post-incident reports including remediation and lessons-learned recommendations
🔹 Updated and refined Incident Response playbooks and runbooks
Key Expertise
🔹 Digital Forensics & Incident Response (DFIR)
🔹 Security incident investigation and response
🔹 Endpoint, network, memory, and cloud forensic analysis
🔹 Forensic evidence collection and preservation
🔹 IOC and TTP identification
🔹 Incident containment, eradication, and recovery
🔹 Incident reporting and root cause analysis
Id
10060
Emplacement
Montréal
Durée De L'emploi
Temps Plein
Nombre D'emplois Vacants
1
Date Limite De Dépôt
Dernière mise à jour:
26-11-04 15:25
The specialist will support the Digital Forensics & Incident Response (DFIR) team in investigating and responding to security incidents, conducting forensic analysis, and supporting containment, eradication, and recovery activities.
Key Responsibilities
🔹 Investigate and respond to security incidents across the organization’s environment
🔹 Triage and investigate security alerts escalated by the SOC into confirmed incidents
🔹 Perform digital forensic analysis on compromised or suspicious systems, including endpoint, network, memory, and cloud environments
🔹 Establish root cause, scope, and incident timelines through forensic analysis
🔹 Collect and preserve forensic evidence following chain-of-custody procedures
🔹 Identify Indicators of Compromise (IOCs) and adversary TTPs and share findings with CTI and Detection Engineering teams
🔹 Support containment, eradication, and recovery activities in coordination with IT and infrastructure teams
🔹 Draft incident reports and post-incident reviews, including root cause analysis and remediation recommendations
🔹 Contribute to and refine Incident Response playbooks and runbooks
🔹 Collaborate with SOC, CTI, Detection Engineering, and Red Team stakeholders on incident handling and lessons learned
Key Deliverables
🔹 Completed incident investigations with documented timelines, root cause, and impact assessments
🔹 Forensic evidence packages, including disk, memory, network, and cloud artifacts, preserved according to chain-of-custody standards
🔹 IOC and TTP reporting to support CTI and Detection Engineering improvements
🔹 Post-incident reports including remediation and lessons-learned recommendations
🔹 Updated and refined Incident Response playbooks and runbooks
Key Expertise
🔹 Digital Forensics & Incident Response (DFIR)
🔹 Security incident investigation and response
🔹 Endpoint, network, memory, and cloud forensic analysis
🔹 Forensic evidence collection and preservation
🔹 IOC and TTP identification
🔹 Incident containment, eradication, and recovery
🔹 Incident reporting and root cause analysis
Id
10060
Emplacement
Montréal
Durée De L'emploi
Temps Plein
Nombre D'emplois Vacants
1
Date Limite De Dépôt
Dernière mise à jour:
26-11-04 15:25
More about this job
Responsibilities
Investigate and respond to security incidents, conduct forensic analysis across endpoint, network, memory, and cloud environments, and establish incident scope, timelines, and root causes. Preserve evidence, support containment through recovery, report findings and recommendations, and collaborate with SOC, CTI, Detection Engineering, Red Team, and infrastructure stakeholders.
Requirements
The role seeks an experienced DFIR specialist with expertise in security incident investigation and response, forensic analysis, and evidence preservation. The specialist should be able to identify IOCs and adversary TTPs, support incident remediation, and produce incident reports and response playbooks.
Skills
- Digital Forensics
- Incident Response
- Security Incident Investigation
- Endpoint Forensics
- Network Forensics
- Memory Forensics
- Cloud Forensics
- Forensic Evidence Collection
- Chain Of Custody
- Root Cause Analysis
- IOC Identification
- TTP Identification
- Incident Containment
- Incident Eradication
- Incident Recovery
- Incident Reporting
Visa sponsorship
Not detected in the job text
Categories
- Security & Safety
- Technology
Keywords
- Digital Forensics And Incident Response
- DFIR
- Security Incident Investigation
- Security Operations Center
- SOC
- Endpoint Forensics
- Network Forensics
- Memory Forensics
- Cloud Forensics
- Forensic Evidence
- Chain Of Custody
- Indicators Of Compromise
- IOCs
- Adversary Tactics, Techniques, And Procedures
- TTPs
- Threat Intelligence
- CTI
- Detection Engineering
- Incident Containment
- Incident Eradication
- Incident Recovery
- Root Cause Analysis
- Incident Timelines
- Incident Reporting
- Post-Incident Reviews
- Incident Response Playbooks
- Runbooks
- Red Team