> Markdown version of [/jobs/ext/4702048-advanced-cyber-unit-analyst-ai-specialist](https://www.wearedevelopers.com/jobs/ext/4702048-advanced-cyber-unit-analyst-ai-specialist). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Advanced Cyber Unit Analyst - AI Specialist

- **Company:** Rolls-Royce
- **Location:** Indianapolis, IN, United States
- **Experience:** Experienced
- **Salary:** $98,566 - $160,169
- **Contract:** Permanent contract
- **Skills:** Active Directory, Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Microsoft Azure, Bash Shell, Cloud Computing Security, Cyber Security, Python (Programming Language), Machine Learning, Network Protocols, Windows PowerShell, Red Team (Cyber Security), Security Information and Event Management, EndPointSecurity, Scripting, Large Language Models, Mitre Att&ck, QRadar, Cyber Threat Analysis, Information Technology, Cybercrime, Machine Learning Operations, Splunk, Security Orchestration, Automation & Response
- **Published:** November 13, 2026
- **Apply:** https://www.careerbuilder.com/job-details/advanced-cyber-unit-analyst-ai-specialist-indianapolis-in--cf270563-fe54-440a-9e51-728d14b3d0bf

## About the Role

Artificial Intelligence (AI), Analysis Skills, Artificial Intelligence (AI), Analysis Skills, Propulsion, Problem Solving Skills, Incident Response, Machine Tool, Hunting, Incident Management, * Associate's Degree in Cyber Security, Computer Science, or Technology and 4+ years of experience in security operations, threat hunting, incident response or closely related security role OR

 * Bachelor Degree in Cyber Security, Computer Science or Technology and 2+ years of experience in security operations, threat hunting, incident response or closely related security role OR
 * Master's of Science in Cyber Security, Computer Science or Technology OR
 * PhD degree
 * In order to be considered for this role, you must be a US citizen

Preferred Requirements:

 * Hands-on experience with SIEM platforms (e.g., Splunk, Sentinel, QRadar, Elastic) and EDR (e.g., Defender for Endpoint, CrowdStrike, Carbon Black)
 * Strong understanding of network protocols, Active Directory, and common attack techniques (MITRE ATT&CK fluency)
 * Proficiency in at least one scripting language (Python preferred)
 * Experience triaging and responding to real-world security incidents
 * Experience implementing or operating ML/AI-based security tools
 * Familiarity with threat intelligence platforms and community (e.g., MISP, OTX)
 * Cloud security experience (AWS, Azure, or GCP)
 * Certifications: GCIH, GCTI/GCDA, OSCP, BTL1, CRTO, CySA+, or equivalent

Our vision is to ensure that the quality and dynamism that shaped our history continues into our future. It's a bold pursuit, and we never stop striving to go further, faster, and better. We lead progress, creating the technologies that move us forward. If you're driven to grow, to learn, and to make a lasting difference, this is where you belong.

## Description

An Exciting opportunity for an Advanced Cyber Unit Analyst has arisen who is as comfortable chasing an active threat as they are building the tooling that catches the next one. This is a hybrid security operations and engineering role: you will be a full member of our Computer Incident Response Team (CIRT), receiving and triaging escalations from the SOC, then stepping into proactive threat hunting and red teaming activities during periods without major incidents.

What you will be doing:

 1. Incident Response & CIRT Operations (25%)

 * Serve as a core member of the CIRT, receiving escalations from the SOC and owning them through full lifecycle management - triage, containment, eradication, recovery, and post-incident review
 * Lead and support major incident response efforts, coordinating with engineering, IT, legal, and management and develop and maintain incident response playbooks aligned to MITRE ATT&CK and NIST frameworks
 * Conduct post-incident reviews and drive actionable remediation

 2. Threat Hunting & Red Teaming (25%)

 * Perform hypothesis-driven threat hunting during periods of low incident volume, targeting our most likely adversary TTPs
 * Execute internal red team exercises and adversary emulation (initial access, lateral movement, persistence, exfiltration) to validate our detection coverage

 3. Security Automation (25%)

 * Build and maintain automation for alert triage, log collection, IOC enrichment, and response actions
 * Develop SOAR playbooks, custom integrations, and scripting (Python, PowerShell, Bash) to improve efficiency and automate repetitive CIRT tasks (asset lookup, isolation, credential resets, report generation)
 * Integrate third-party tools and APIs across the security stack (SIEM, EDR, TI, ticketing)

 4. AI in Cyber Security (25%)

 * Evaluate, implement, and operationalize AI/ML capabilities across our security processes (e.g., alert prioritization, anomaly detection, summarization, LLM-assisted triage)
 * Pilot and productionize AI-powered tooling, establishing guardrails, monitoring, and feedback loops and work with engineering to secure AI/LLM-based security solutions and protect sensitive data in AI pipelines
 * Track emerging AI security trends (including AI-assisted attacks and AI defense techniques) and present findings to the team