Cloud Security Specialist – Detection Engineering

As a Cloud Security Specialist joining Ubisoft's Detection Engineering team within the SOC, you design, build, and tune the detection content that catches attacks against Ubisoft's cloud infrastructure, CI/CD pipelines, and DevOps tooling. Your value comes from deep, hands-on knowledge of how cloud environments and pipelines actually work — gained as a cloud, DevOps, or CI/CD engineer — which you will apply, with dedicated mentoring and training, to detection engineering methodology, SIEM content development, and threat hunting. You are not securing or building cloud infrastructure in this role: you are hunting and detecting the attackers who target it, and increasingly, using LLMs and GenAI to do it faster and building the automation that responds once a threat is confirmed.

Responsibilities

• Develop and maintain detection content (Splunk/SIEM, cloud-native logging, IDS) targeting attacks against cloud infrastructure, IAM, containers/Kubernetes, and CI/CD pipelines;
• Define detection engineering processes and standards specific to cloud and DevOps attack surfaces;
• Conduct threat hunting engagements across cloud environments and CI/CD telemetry;
• Research attacker TTPs targeting cloud and CI/CD (MITRE ATT&CK for Cloud, supply chain attacks, IAM abuse, container escape, pipeline poisoning) and translate them into detection logic;
• Leverage LLMs and GenAI to accelerate detection engineering work — generating and tuning detection logic, summarizing and enriching alerts, and speeding up hunting and triage;
• Design and build automated response playbooks (SOAR or custom orchestration) that contain or remediate cloud/CI-CD threats without manual intervention;
• Validate detection coverage through purple-teaming and adversary emulation against cloud environments;
• Mentor SOC analysts on investigating cloud-related alerts and the data sources available to them;
• Work with CTI and Incident Response to convert cloud threat intelligence into new detections and response automation;
• Identify logging and telemetry gaps in cloud/CI-CD systems that limit detection coverage, and drive requirements back to platform teams.

• Significant hands-on experience operating, building, or securing public cloud environments (AWS, Azure, or GCP) as a cloud engineer, DevOps engineer, SRE, or cloud security specialist;
• Solid understanding of CI/CD pipelines and tooling (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, etc.) and how they get attacked;
• Familiarity with infrastructure-as-code (Terraform, CloudFormation, Pulumi) and cloud-native logging/telemetry (CloudTrail, Azure Activity Log, GCP Audit Logs, etc.);
• Scripting ability (Python, Go, or similar) to build detection logic and automate analysis and response;
• Solid grasp of cloud security fundamentals: IAM, network segmentation, container/Kubernetes security, secrets management;
• Experience or strong interest in applying LLMs/GenAI to security use cases (prompt engineering, RAG, agentic workflows) is a significant asset;
• Experience building security automation or orchestration (SOAR platforms, custom workflow engines, scripted response) is a plus;
• No prior SOC or detection engineering experience required — what matters is a strong analytical mindset and genuine interest in threat detection; you will be trained on Splunk content development, threat hunting methodology, and detection engineering practice;
• Cloud or security certification is an asset (AWS/Azure/GCP security specialty, CKS, GCDA, or equivalent).