Digital Forensics Analyst

Rolls-Royce•Indianapolis, IN

1d•Hybrid

About The Position

We are seeking a highly motivated DFIR Specialist to join our Purple Team. This role bridges offensive and defensive security operations by combining incident response, threat hunting, digital forensics, adversary emulation, and detection engineering. The ideal candidate enjoys investigating real-world attacks, understanding adversary behavior, improving detection capabilities, and working collaboratively with red and blue teams to strengthen security posture.

Requirements

Associate's degree in Cybersecurity, Computer Science, Information Technology, Mathematics and 2 + years of relevant experience OR; Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Mathematics and 2 + years of relevant experience OR; Master's degree in Cybersecurity, Computer Science, Information Technology, Mathematics OR; PhD in Cybersecurity, Computer Science, Information Technology, Mathematics OR; In lieu of a degree must have 6+ years' experience in Cyber Security or Information Technology
Must be a US Citizen

Nice To Haves

3+ years focused on incident response, threat hunting, or DFIR.
6+ years' experience in Cyber Security or Information Technology
Experience with various memory acquisition techniques/tools: FTK Imager, Volatility 3, Velociraptor for remote memory dumps
Experience with enterprise SIEM platforms such as: Microsoft Sentinel, Splunk Enterprise Security, Elastic Security
Experience with EDR technologies including: Microsoft Defender XDR, CrowdStrike Falcon, SentinelOne Singularity
Familiarity with: Windows Event Logs, Sysmon, KQL, Sigma rules, YARA, PowerShell, Python, Memory analysis, Malware triage
Understanding of: Attack chains, Identity-based attacks, Cloud attack techniques, Detection engineering principles
Experience with adversary emulation frameworks.
Familiarity with: Caldera, Prelude Operator, Velociraptor
Cloud security investigation experience in: Microsoft Azure, Amazon AWS, Google Cloud
Certifications: GIAC certifications such as GCFA, GCIH, GCFE, etc.
Microsoft certifications such as SC-200, SC-400, AZ-500
CISSP, CCSP

Responsibilities

Lead or support investigations involving malware, ransomware, insider threats, and advanced persistent threats.
Perform endpoint, memory, disk, and cloud forensics.
Conduct triage activities during security incidents.
Coordinate containment, eradication, and recovery efforts.
Develop incident response playbooks and procedures.
Produce executive and technical incident reports.
Conduct proactive hunts across endpoints, identity, cloud, and network telemetry.
Develop hypotheses based on emerging adversary techniques.
Analyze attack patterns using frameworks such as MITRE ATT&CK.
Identify gaps in visibility and logging.
Collaborate with red team operators to emulate adversary tactics.
Validate detections against simulated attacks.
Assist in planning and executing purple team exercises.
Measure and improve detection coverage.
Map detections and hunting content to ATT&CK techniques.
Develop and tune detections within SIEM and EDR platforms.
Reduce false positives while improving fidelity.
Create custom analytics, dashboards, and monitoring content.
Automate repetitive investigation tasks through scripting.
Acquire and analyze forensic artifacts from: Windows systems, Linux systems, Cloud environments, Containers, Identity providers.
Perform timeline reconstruction.
Analyze persistence mechanisms.

Benefits

health, dental, vision, disability, life and accidental death & dismemberment insurance
a flexible spending account
a health savings account
a 401(k) retirement savings plan with a company match
Employee Assistance Program
Paid Time Off
certain paid holidays
paid parental and family care leave
tuition reimbursement
a long-term incentive plan