Cyber Defense Analyst II

Application close date:
Applications will be accepted on an ongoing basis until the requisition is closed.

At Blue Origin, we envision millions of people living and working in space for the benefit of Earth. We’re working to develop reusable, safe, and low-cost space vehicles and systems within a culture of safety, collaboration, and inclusion. Join our team of problem solvers as we add new chapters to the history of spaceflight!

This role is part of Blue National Security (BNS), where our focus is the design, development, and delivery of launch and spacecraft systems for national security missions. Through Blue Ring, our all-in-one, high-powered hybrid solar-electric and chemical-propelled spacecraft, we provide unmatched mission maneuverability, versatility, and capacity at dramatically lower-profile costs.

Blue National Security builds and operates space systems for the Intelligence Community and Department of Defense. Someone has to be watching those systems continuously — and that's this role.

We're looking for a Cyber Defense Analyst to monitor, investigate, and respond across BNS classified enclaves, mission ground systems, and labs. You'll work real events on real national security systems, and you'll do it alongside senior engineers who will teach you the environment rather than hand you a queue and walk away.

This is a hands-on-keyboard role. You'll spend your days in consoles, terminals, and logging data. You'll also get your hands on the tooling itself, helping deploy sensors, onboard log sources, and tune detections under the direction of our senior engineers. That's how you'll learn this environment, and it's the fastest path to becoming the engineer who designs the next one.

If you're coming off a military cyber protection team, a government SOC, or a service watch floor and you want to keep growing technically rather than get slotted into a ticket queue, this is a strong landing spot.

What You'll Do

- Monitor and triage. Work security events and alerts across SIEM, EDR, network sensors, and audit logs. Determine what's noise, what's misconfiguration, and what warrants escalation.
- Investigate. Pull the threads — pivot across host, network, and identity data to build a picture of what actually happened, and document it clearly.
- Respond. Serve as first responder during incidents. Execute containment steps per playbook, preserve evidence, build timelines, and support senior engineers leading the response.
- Hunt. Participate in structured hunts, initially alongside senior team members and increasingly on your own hypotheses as you learn what "normal" looks like here.
- Support audit and insider threat review. Perform privileged user activity monitoring and audit log review in partnership with Security and Counterintelligence.
- Stand watch during mission events. Provide heightened monitoring coverage during launches, mission operations, and other critical windows.
- Get hands on the tooling. Assist with sensor deployment, log source onboarding, and agent rollout across enclaves under engineering direction.
- Tune and improve detections. Reduce false positives, validate rule coverage, and propose new detections based on what you find in the data.
- Improve the playbooks. Execute response procedures and flag every gap you hit — you'll be the first to find them, and your input drives the rewrites.
- Automate what you repeat. Script recurring triage, enrichment, and reporting tasks. We'll help you build this skill if you don't have it yet.

Required Qualifications

- 2+ years of hands-on experience in security operations, incident response, IT operations, or system administration or equivalent military/government cyber experience
- Working knowledge of network protocols and Windows and Linux fundamentals
- Familiarity with SIEM and EDR concepts and the ability to investigate events using them
- Understanding of common attack techniques and exposure to the MITRE ATT&CK framework
- Clear, concise written communication — your investigation notes will be read by senior staff and government customers
- Genuine curiosity and the instinct to keep pulling on a thread when something doesn't add up
- Active U.S. Government Top Secret clearance with SCI eligibility and eligibility for SAP access determination; U.S. citizenship
- DoD 8140 CSSP Analyst or IAT Level II certification (Security+ CE or equivalent) at hire or within [6] months

A degree is not required. Equivalent military, government, or hands-on technical experience is fully accepted.

Preferred Qualifications

- Prior military cyber experience (17C, 1B4, CTN, 1721, or equivalent) or CPT/CST assignment
- Any scripting exposure — Python, PowerShell, or Bash
- Query language familiarity — KQL, SPL, or similar
- Prior work in classified DoD or IC environments
- Exposure to forensics, malware triage, or detection rule development
- Security+, CySA+, GSEC, GCIH, or similar
- Active TS/SCI with polygraph

Why This Role

Most early-career defensive cyber jobs are queue jobs. You close tickets, escalate anything interesting, and learn very little about the systems you're supposedly defending.

This team is small enough that you can't be siloed. You'll sit next to the engineers building the enclaves, help deploy the sensors you'll be watching, and see your tuning recommendations go live. When you find a gap during a hunt, you'll be in the room when we decide how to close it.

We're hiring at this level specifically to grow people into senior engineers. If that's the trajectory you want, we'll be explicit about what it takes and invest accordingly.

Logistics

- Onsite in classified spaces; no telework by nature of the role
- [Select one:] Standard business hours with on-call rotation / Shift work supporting [extended-hours / 24×7] coverage, including nights, weekends, and holidays on a rotating schedule
- On-call rotations are supported by senior engineering escalation — you will not be the last line of defense alone
- Heightened coverage expectations during launches and mission-critical events
- Limited travel, up to 10%
- Must be able to obtain and maintain access to classified facilities; periodic polygraph may be required

Base Pay Range for:
CO applicants is $90,934.00 - $127,307.25
WA applicants is $99,201.00 - $138,880.35

Other site ranges may differ

Culture Statement

Don’t meet all desired requirements? Studies have shown that some people are less likely to apply to jobs unless they meet every single desired qualification. At Blue Origin, we are dedicated to building an authentic workplace, so if you’re excited about this role but your past experience doesn’t align perfectly with every desired qualification in the job description, we encourage you to apply anyway. You may be just the right candidate for this or other roles.

Export Control Regulations

Applicants for employment at Blue Origin must be a U.S. citizen or national, U.S. permanent resident (i.e. current Green Card holder), or lawfully admitted into the U.S. as a refugee or granted asylum.

Background Check