Advanced Cyber Unit Analyst – AI Specialist

Rolls-Royce; Indianapolis (IN); On-site; USD 99,000 - 160,000; Full time

Job summary

Rolls-Royce in Indianapolis, IN is seeking an Advanced Cyber Unit Analyst – AI Specialist to join a hybrid security operations and engineering team. You will be a core member of the CIRT, perform threat hunting, red teaming, and develop automation and AI-enabled security tooling.

You’ll implement MITRE ATT&CK-aligned playbooks, triage incidents, and pilot AI-powered solutions while safeguarding sensitive data in AI pipelines. US citizenship required.

Qualifications

• Associate’s degree in Cyber Security, Computer Science, or Technology with 4+ years of security ops, threat hunting, or incident response.
• Bachelor’s degree in Cyber Security, Computer Science or Technology with 2+ years in security ops, threat hunting, or incident response.
• Master’s of Science in Cyber Security, Computer Science or Technology, or PhD degree.
• US citizenship is required for consideration.

Responsibilities

• Own escalations through full lifecycle: triage, containment, eradication, recovery, and post-incident review.
• Lead and support major incident response efforts, coordinating across engineering, IT, legal, and management.
• Perform hypothesis-driven threat hunting and conduct red team exercises to validate detections.
• Build and maintain automation for alert triage, log collection, IOC enrichment, and response actions; develop SOAR playbooks and integrations.
• Evaluate, pilot, and operationalize AI/ML capabilities in security processes; monitor AI tooling and protect data in AI pipelines.

Skills

Threat hunting

Incident response

Security operations

Python scripting

PowerShell scripting

ML/AI security

Education

Associate degree

Bachelor's degree

Master's degree

PhD degree

Tools

Splunk

Sentinel

QRadar

Elastic

Defender for Endpoint

CrowdStrike

Carbon Black

Job description

Job Description

Job Title: Advanced Cyber Unit Analyst – AI Specialist

Working Pattern: Fulltime

Working Location: Indianapolis, IN

Relocation assistance will be provided if applicable.

Why Rolls-Royce?

At Rolls-Royce we are proud to be a business that has truly helped to shape the modern world and are committed to always being a force for progress; powering, protecting and connecting people everywhere.

By joining Rolls-Royce, you’ll have the opportunity to create world-class power and propulsion solutions, pushing your problem-solving and ingenuity, to deliver real impact that puts safety first.

You’ll be given responsibility and the opportunity to grow in our high-performance culture. This is Infinite Potential. And it’s your chance to really shine and contribute to one of the world’s most recognized brands and a beacon for engineering excellence.

Position Summary

An Exciting opportunity for an Advanced Cyber Unit Analyst has arisen who is as comfortable chasing an active threat as they are building the tooling that catches the next one. This is a hybrid security operations and engineering role: you will be a full member of our Computer Incident Response Team (CIRT), receiving and triaging escalations from the SOC, then stepping into proactive threat hunting and red teaming activities during periods without major incidents.

What you will be doing:

1. Incident Response & CIRT Operations (25%)

• Serve as a core member of the CIRT, receiving escalations from the SOC and owning them through full lifecycle management — triage, containment, eradication, recovery, and post-incident review
• Lead and support major incident response efforts, coordinating with engineering, IT, legal, and management and develop and maintain incident response playbooks aligned to MITRE ATT&CK and NIST frameworks
• Conduct post-incident reviews and drive actionable remediation

2. Threat Hunting & Red Teaming (25%)

• Perform hypothesis-driven threat hunting during periods of low incident volume, targeting our most likely adversary TTPs
• Execute internal red team exercises and adversary emulation (initial access, lateral movement, persistence, exfiltration) to validate our detection coverage

3. Security Automation (25%)

• Build and maintain automation for alert triage, log collection, IOC enrichment, and response actions
• Develop SOAR playbooks, custom integrations, and scripting (Python, PowerShell, Bash) to improve efficiency and automate repetitive CIRT tasks (asset lookup, isolation, credential resets, report generation)
• Integrate third-party tools and APIs across the security stack (SIEM, EDR, TI, ticketing)

4. AI in Cyber Security (25%)

• Evaluate, implement, and operationalize AI/ML capabilities across our security processes (e.g., alert prioritization, anomaly detection, summarization, LLM-assisted triage)
• Pilot and productionize AI-powered tooling, establishing guardrails, monitoring, and feedback loops and work with engineering to secure AI/LLM-based security solutions and protect sensitive data in AI pipelines
• Track emerging AI security trends (including AI-assisted attacks and AI defense techniques) and present findings to the team

Basic Requirements:

• Associate’s Degree in Cyber Security, Computer Science, or Technology and 4+ years of experience in security operations, threat hunting, incident response or closely related security role OR
• Bachelor Degree in Cyber Security, Computer Science or Technology and 2+ years of experience in security operations, threat hunting, incident response or closely related security role OR
• Master’s of Science in Cyber Security, Computer Science or Technology OR
• PhD degree
• In order to be considered for this role, you must be a US citizen

Preferred Requirements:

• Hands-on experience with SIEM platforms (e.g., Splunk, Sentinel, QRadar, Elastic) and EDR (e.g., Defender for Endpoint, CrowdStrike, Carbon Black)
• Strong understanding of network protocols, Active Directory, and common attack techniques (MITRE ATT&CK fluency)
• Proficiency in at least one scripting language (Python preferred)
• Experience triaging and responding to real-world security incidents
• Experience implementing or operating ML/AI-based security tools
• Familiarity with threat intelligence platforms and community (e.g., MISP, OTX)
• Cloud security experience (AWS, Azure, or GCP)
• Certifications: GCIH, GCTI/GCDA, OSCP, BTL1, CRTO, CySA+, or equivalent

Our vision is to ensure that the quality and dynamism that shaped our history continues into our future. It’s a bold pursuit, and we never stop striving to go further, faster, and better. We lead progress, creating the technologies that move us forward. If you’re driven to grow, to learn, and to make a lasting difference, this is where you belong.

Rolls-Royce is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to any protected characteristics. We are committed to providing a respectful and non-discriminatory workplace where individuality is valued and everyone can thrive.

Infinite Potential

Closing Date: November 18, 2026

Job Category

Information Technology

Job Posting Date

10 Nov 2026; 00:11

Pay Range

Pay ranges for remote employees are based on the state where the employee resides and may vary from the posted range.

$98,566 - $160,169-Annually

Location:

Indianapolis, IN

Benefits

Rolls-Royce provides a comprehensive and competitive Total Rewards package that includes base pay and a discretionary bonus plan. Eligible employees may have the opportunity to enroll in other benefits, including health, dental, vision, disability, life and accidental death & dismemberment insurance; a flexible spending account; a health savings account; a 401(k) retirement savings plan with a company match; Employee Assistance Program; Paid Time Off; certain paid holidays; paid parental and family care leave; tuition reimbursement; and a long-term incentive plan. The options available to an employee may vary depending on eligibility factors such as date of hire, employment type, and the applicability of collective bargaining agreements.