Cyber Defense Analyst II - Onsite Incident Response & Hunting

Blue Origin LLC; Littleton (CO); On-site; USD 91,000 - 127,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Parental leave

Disability insurance

401(k) with company match

Education Support Program

Stock options

Paid time off

Job summary

Blue Origin is seeking a Cyber Defense Analyst to monitor, investigate, and respond across classified enclaves and mission systems. You will work with senior engineers, deploy sensors, and tune detections in a hands-on role that grows technical expertise in national security environments.

You’ll triage security events, conduct structured hunts, and support audits while adhering to playbooks and security guidelines.

Qualifications

• 2+ years of hands-on experience in security operations, incident response, IT operations, or system administration or equivalent military/government cyber experience.
• Working knowledge of network protocols and Windows and Linux fundamentals.
• Familiarity with SIEM and EDR concepts and the ability to investigate events using them.
• Understanding of common attack techniques and exposure to the MITRE ATT&CK framework.
• Clear, concise written communication — your investigation notes will be read by senior staff and government customers.
• Genuine curiosity and the instinct to keep pulling on a thread when something doesn't add up.
• Active U.S. Government Top Secret clearance with SCI eligibility and eligibility for SAP access determination; U.S. citizenship.
• DoD 8140 CSSP Analyst or IAT Level II certification (Security+ CE or equivalent) at hire or within 6 months.
• A degree is not required. Equivalent military, government, or hands-on technical experience is fully accepted.

Responsibilities

• Monitor and triage security events across SIEM, EDR, network sensors, and audit logs; determine noise vs. real threats.
• Investigate by pivoting across host, network, and identity data and document findings clearly.
• Serve as first responder during incidents; execute containment per playbook and preserve evidence.
• Participate in structured hunts with senior team members and increasingly on your own hypotheses.
• Support audit and insider threat review through privileged user activity monitoring and log review.
• Stand watch during launches and mission events with heightened monitoring.
• Assist with sensor deployment, log source onboarding, and agent rollout under engineering direction.
• Tune and improve detections; reduce false positives and expand coverage.
• Improve playbooks; identify gaps and drive rewrites.
• Automate recurring triage, enrichment, and reporting tasks.

Skills

Security operations

Incident response

Network fundamentals

SIEM/EDR

MITRE ATT&CK

Written communication

Curiosity

Job description

Blue Origin is seeking a Cyber Defense Analyst to monitor, investigate, and respond across classified enclaves and mission systems. You will work with senior engineers, deploy sensors, and tune detections in a hands-on role that grows technical expertise in national security environments.

You’ll triage security events, conduct structured hunts, and support audits while adhering to playbooks and security guidelines.