Arobas Personnel is looking for an experienced DFIR / Incident Response Specialist for a contract opportunity with one of our clients.

The specialist will support the Digital Forensics & Incident Response (DFIR) team in investigating and responding to security incidents, conducting forensic analysis, and supporting containment, eradication, and recovery activities.

Key Responsibilities

- Investigate and respond to security incidents across the organization’s workplace
- Triage and investigate security alerts escalated by the SOC into confirmed incidents
- Perform digital forensic analysis on compromised or suspicious systems, including endpoint, network, memory, and cloud environments
- Establish root cause, scope, and incident timelines through forensic analysis
- Collect and preserve forensic evidence following chain‑of‑custody procedures
- Identify Indicators of Compromise (IOCs) and adversary TTPs and share findings with CTI and Detection Engineering teams
- Support containment, eradication, and recovery activities in coordination with IT and infrastructure teams
- Draft incident reports and post-incident reviews, including root cause analysis and remediation recommendations




- Contribute to and refine Incident Response playbooks and runbooks
- Collaborate with SOC, CTI, Detection Engineering, and Red Team stakeholders on incident handling and lessons learned

Key Deliverables

- Completed incident investigations with documented timelines, root cause, and impact assessments
- Forensic evidence packages, including disk, memory, network, and cloud artifacts, preserved according to chain‑of‑custody standards
- IOC and TTP reporting to support CTI and Detection Engineering improvements
- Post-incident reports including remediation and lessons-learned recommendations
- Updated and refined Incident Response playbooks and runbooks

Key Expertise

- Digital Forensics & Incident Response (DFIR)
- Security incident investigation and response
- Endpoint, network, memory, and cloud forensic analysis
- Forensic evidence collection and preservation
- IOC and TTP identification
- Incident containment, eradication, and recovery
- Incident reporting and root cause analysis

Id 10060

Emplacement Montréal

Durée De L'emploi Temps Plein

Nombre D'emplois Vacants 1

Date Limite De Dépôt

Dernière mise à jour: 26-11-04 15:25

📌 DFIR / Incident Response Specialist (Montreal)
🏢 Arobas Personnel
📍 Montreal