Cyber Defense Analyst

About the role

At Blue Origin we envision millions of people living and working in space for the benefit of Earth. We develop reusable, safe, and low‑cost space vehicles and systems within a culture of safety, collaboration, and inclusion. The role is part of the In‑Space Systems business unit, which focuses on space infrastructure and increasing mobility on‑orbit. Blue National Security (BNS) builds and operates space systems for the Intelligence Community and Department of Defense. We are looking for a Cyber Defense Analyst to monitor, investigate, and respond across BNS classified enclaves, mission ground systems, and labs. This is a hands‑on‑keyboard role where you will spend your days in consoles, terminals, and logging data, and you will also get your hands on the tooling itself, helping deploy sensors, onboard log sources, and tune detections under the direction of senior engineers.

Responsibilities

• Monitor and triage security events and alerts across SIEM, EDR, network sensors, and audit logs; determine what is noise, misconfiguration, or warrants escalation.
• Investigate incidents by pulling threads across host, network, and identity data, building a clear picture of what happened, and documenting it.
• Respond as first responder during incidents: execute containment steps per playbook, preserve evidence, build timelines, and support senior engineers leading the response.
• Participate in structured hunts, initially alongside senior team members and increasingly on your own hypotheses.
• Support audit and insider‑threat review by performing privileged‑user activity monitoring and audit‑log review in partnership with Security and Counterintelligence.
• Stand watch during mission events, providing heightened monitoring coverage during launches, mission operations, and other critical windows.
• Assist with sensor deployment, log‑source onboarding, and agent rollout across enclaves under engineering direction.
• Tune and improve detections: reduce false positives, validate rule coverage, and propose new detections based on data analysis.
• Improve playbooks by executing response procedures, flagging gaps, and driving rewrites.
• Automate recurring triage, enrichment, and reporting tasks; develop scripts as needed.

Required Qualifications

• Entry‑level hands‑on experience in security operations, incident response, IT operations, or system administration, or equivalent military/government cyber experience.
• Working knowledge of network protocols and Windows and Linux fundamentals.
• Familiarity with SIEM and EDR concepts and ability to investigate events using them.
• Understanding of common attack techniques and exposure to the MITRE ATT&CK framework.
• Clear, concise written communication – investigation notes will be read by senior staff and government customers.
• Genuine curiosity and persistence when something doesn’t add up.
• Active U.S. Government Top Secret clearance with SCI eligibility and eligibility for SAP access determination.
• DoD 8140 CSSP Analyst or IAT Level II certification (Security+ CE or equivalent) at hire or within six months.
• A degree is not required; equivalent military, government, or hands‑on technical experience is fully accepted.

Preferred Qualifications

• Prior military cyber experience (e.g., 17C, 1B4, CTN, 1721, or equivalent) or CPT/CST assignment.
• Scripting exposure – Python, PowerShell, or Bash.
• Familiarity with query languages such as KQL, SPL, or similar.
• Prior work in classified DoD or IC environments.
• Exposure to forensics, malware triage, or detection‑rule development.
• Security‑related certifications (Security+, CySA+, GSEC, GCIH, or similar).
• Active TS/SCI with polygraph.

Why This Role

Most early‑career defensive cyber jobs are queue‑driven, but this team is small enough that you won’t be siloed. You’ll sit next to the engineers building the enclaves, help deploy the sensors you’ll be watching, and see your tuning recommendations go live. When you find a gap during a hunt, you’ll be in the room when the team decides how to close it. The role is designed to grow people into senior engineers, with explicit expectations and investment in your development.

Logistics

• On‑site work in classified spaces; no telework by nature of the role.
• Heightened coverage expectations during launches and mission‑critical events.
• Limited travel, up to 10%.
• Must be able to obtain and maintain access to classified facilities; periodic polygraph may be required.

Pay

Base Pay Range: For Colorado applicants $74,537.00 – $104,351.10; for Washington applicants $81,313.00 – $113,837.85. Other site ranges may differ.

Benefits

• Medical, dental, vision, basic and supplemental life insurance.
• Paid parental leave.