Arobas Personnel is looking for an experienced DFIR / Incident Response Specialist for a contract opportunity with one of our clients. The specialist will support the Digital Forensics & Incident Response (DFIR) team in investigating and responding to security incidents, conducting forensic analysis, and supporting containment, eradication, and recovery activities. Key Responsibilities

Investigate and respond to security incidents across the organization’s workplace Triage and investigate security alerts escalated by the SOC into confirmed incidents Perform digital forensic analysis on compromised or suspicious systems, including endpoint, network, memory, and cloud environments Establish root cause, scope, and incident timelines through forensic analysis Collect and preserve forensic evidence following chain‑of‑custody procedures Identify

Indicators of Compromise (IOCs) and adversary TTPs and share findings with CTI and Detection Engineering teams Support containment, eradication, and recovery activities in coordination with IT and infrastructure teams Draft incident reports and post-incident reviews , including root cause analysis and remediation recommendations Contribute to and refine





Incident Response playbooks and runbooks Collaborate with

SOC, CTI, Detection Engineering, and Red Team stakeholders on incident handling and lessons learned Key Deliverables

Completed incident investigations with documented timelines, root cause, and impact assessments Forensic evidence packages , including disk, memory, network, and cloud artifacts, preserved according to chain‑of‑custody standards IOC and TTP reporting to support CTI and Detection Engineering improvements Post-incident reports including remediation and lessons-learned recommendations Updated and refined

Incident Response playbooks and runbooks Key Expertise

Digital Forensics & Incident Response (DFIR) Security incident investigation and response Endpoint, network, memory, and cloud forensic analysis Forensic evidence collection and preservation IOC and TTP identification Incident containment, eradication, and recovery Incident reporting and root cause analysis Id 10060 Emplacement Montréal Durée De L'emploi Temps Plein Nombre D'emplois Vacants 1 Date Limite De Dépôt Dernière mise à jour: 26-11-04 15:25

📌 DFIR / Incident Response Specialist (Winnipeg)
🏢 Arobas Personnel
📍 Winnipeg