Incident Response Security Analyst

The incumbent works in coordination with all production and services teams, and other security relays to ensure the coherent execution of the Ubisoft security strategy.

Moreover, they provide informational and technical security expertise in order to support, ensure and enhance the current security posture of all assets within Ubisoft.

The candidate will perform incident response activities while challenging current processes and suggesting improvements or alternatives. This role operates at the intersection of security operations and real-world business impact—where speed, precision, and judgment matter more than theory.

• Acting as a central point of contact within the global incident response team, the Security Analyst will:
• Analyze and respond to alerts generated by our SIEM (Security Information and Events management) and other security tool suite (EDR, Identity service, etc.) on a day to day basis
• Perform forensic and investigation activities on hosts, network, infrastructure and applications targeted by threat actors
• Identify attacker tactics, techniques, and procedures and proactively hunt for threats based on intelligence and hypothesis.
• Lead incident response activities end to end for incident of low and medium criticality before, during and after incidents;
• Support and coordinate incident response activities for high and critical incidents before, during and after incidents;
• Drive decision-making processes under pressure to determine incident handling approaches (contain vs monitor, isolate vs preserve, shutdown or maintain availability).
• Produce clear investigation reports for technical and non-technical audiences
• Those circumstances may require to outside of traditional working hours.
• Validate and enrich detection by collaborating with detection engineering team and propose alert tuning strategies and implementations.
• Validate and tune our security tool suite by providing feedback to the detection engineering team and suggest improvement plan.
• Participate in the creation and implementation of incident response plans;
• Occasionally participate in internal investigations (local and corporate headquarters) in accordance to established policies;
• Collaborate on threat intelligence activities by performing relevant and efficient analyses and reporting back findings;
• Propose solutions to mitigate identified risks and bring them to an acceptable level for management.
• Carry out all other related tasks.