Cyber Defense Analyst II

Blue Origin•Littleton, CO

4d•Onsite

About The Position

Blue Origin’s Blue National Security (BNS) team designs, develops, and delivers launch and spacecraft systems for national security missions. The Cyber Defense Analyst II monitors, investigates, and responds to security activity across classified enclaves, mission ground systems, and labs. This is a hands-on role involving security consoles, terminals, and log data, as well as supporting deployment and tuning of security tooling under senior engineering direction. The position offers opportunities to work alongside senior engineers and develop toward more advanced engineering responsibilities. The role is onsite in classified spaces and includes heightened monitoring during launches, mission operations, and other critical periods. It involves an on-call rotation supported by senior engineering escalation, limited travel of up to 10%, and the ability to obtain and maintain access to classified facilities. Periodic polygraph may be required. Base pay ranges are $90,934.00–$127,307.25 for Colorado applicants and $99,201.00–$138,880.35 for Washington applicants; ranges for other sites may differ.

Requirements

At least 2 years of hands-on experience in security operations, incident response, IT operations, or system administration, or equivalent military/government cyber experience.
Working knowledge of network protocols and Windows and Linux fundamentals.
Familiarity with SIEM and EDR concepts and the ability to investigate events using them.
Understanding of common attack techniques and exposure to the MITRE ATT&CK framework.
Clear, concise written communication.
Curiosity and persistence in investigating activity that does not add up.
Active U.S. Government Top Secret clearance with SCI eligibility and eligibility for SAP access determination; U.S. citizenship.
DoD 8140 CSSP Analyst or IAT Level II certification, such as Security+ CE or equivalent, at hire or within six months.
Ability to obtain and maintain access to classified facilities.

Nice To Haves

Prior military cyber experience (17C, 1B4, CTN, 1721, or equivalent) or CPT/CST assignment.
Scripting exposure in Python, PowerShell, or Bash.
Familiarity with a query language such as KQL or SPL.
Prior work in classified DoD or Intelligence Community environments.
Exposure to forensics, malware triage, or detection rule development.
Security+, CySA+, GSEC, GCIH, or similar certification.
Active TS/SCI with polygraph.
A degree is not required; equivalent military, government, or hands-on technical experience is accepted.

Responsibilities

Monitor and triage security events and alerts across SIEM, EDR, network sensors, and audit logs; distinguish noise and misconfiguration from activity that warrants escalation.
Investigate events by correlating host, network, and identity data, and document findings clearly.
Serve as a first responder during incidents; execute containment steps according to playbooks, preserve evidence, build timelines, and support senior engineers leading the response.
Participate in structured threat hunts, initially alongside senior team members and increasingly based on independent hypotheses.
Perform privileged-user activity monitoring and audit-log reviews with Security and Counterintelligence.
Provide heightened monitoring coverage during launches, mission operations, and other critical windows.
Assist with security sensor deployment, log-source onboarding, and agent rollout across enclaves under engineering direction.
Tune and improve detections by reducing false positives, validating rule coverage, and proposing detections based on observed data.
Execute response procedures and identify gaps to inform playbook updates.
Script recurring triage, enrichment, and reporting tasks.
Participate in on-call rotations and heightened coverage during mission-critical events.
Travel up to 10%.

Benefits

Medical, dental, and vision insurance.
Basic and supplemental life insurance.
Paid parental leave.
Short- and long-term disability.
401(k) with company match of up to 5%.
Education Support Program.
Stock options for regular employees working at least 20 hours per week.
Paid time off of up to four weeks per year based on weekly scheduled hours.
Up to 14 company-paid holidays.
Depending on role type and job level, potential eligibility for benefits and bonuses based on individual contributions and company results; amounts and eligibility are not guaranteed.