{"id":1066953,"url":"https://alion.io/job/blue-origin-cyber-defense-analyst","title":"Cyber Defense Analyst","company":{"id":3698,"name":"Blue Origin","domain":"blueorigin.com","url":"https://alion.io/company/blueorigin","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":78,"open_postings":308,"ghost_share":0,"stale_share":0.89,"repost_share":0.003,"time_to_fill_p50_days":29,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Littleton, United States","Seattle, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":74537,"max":104351,"currency":"USD","period":"year","gross":null,"usd_annual":104351},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"Bash","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-09-18T00:00:00Z","employer_posted_date":"2026-09-18","last_verified_at":"2026-10-18T05:25:58Z","board_verified":true,"closed_at":null,"days_open":30,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":30},"description":"Application close date:\nApplications will be accepted on an ongoing basis until the requisition is closed.At Blue Origin, we envision millions of people living and working in space for the benefit of Earth. We’re working to develop reusable, safe, and low-cost space vehicles and systems within a culture of safety, collaboration, and inclusion. Join our team of problem solvers as we add new chapters to the history of spaceflight!\nThe role is part of the In-Space Systems business unit, which is focused on addressing two of the most compelling challenges in spaceflight today: space infrastructure and increasing mobility on-orbit.Blue National Security (BNS) builds and operates space systems for the Intelligence Community and Department of Defense. Someone has to be watching those systems continuously - and that's this role.\nWe're looking for a Cyber Defense Analyst to monitor, investigate, and respond across BNS classified enclaves, mission ground systems, and labs. You'll work real events on real national security systems, and you'll do it alongside senior engineers who will teach you the environment rather than hand you a queue and walk away.\nThis is a hands-on-keyboard role. You'll spend your days in consoles, terminals, and logging data. You'll also get your hands on the tooling itself, helping deploy sensors, onboard log sources, and tune detections under the direction of our senior engineers. That's how you'll learn this environment, and it's the fastest path to becoming the engineer who designs the next one.\nIf you're coming off a military cyber protection team, a government SOC, or a service watch floor and you want to keep growing technically rather than get slotted into a ticket queue, this is a strong landing spot.\nWhat You'll Do\nMonitor and triage. Work security events and alerts across SIEM, EDR, network sensors, and audit logs. Determine what's noise, what's misconfiguration, and what warrants escalation.\nInvestigate. Pull the threads - pivot across host, network, and identity data to build a picture of what actually happened, and document it clearly.\nRespond. Serve as first responder during incidents. Execute containment steps per playbook, preserve evidence, build timelines, and support senior engineers leading the response.\nHunt. Participate in structured hunts, initially alongside senior team members and increasingly on your own hypotheses as you learn what \"normal\" looks like here.\nSupport audit and insider threat review. Perform privileged user activity monitoring and audit log review in partnership with Security and Counterintelligence.\nStand watch during mission events. Provide heightened monitoring coverage during launches, mission operations, and other critical windows.\nGet hands on the tooling. Assist with sensor deployment, log source onboarding, and agent rollout across enclaves under engineering direction.\nTune and improve detections. Reduce false positives, validate rule coverage, and propose new detections based on what you find in the data.\nImprove the playbooks. Execute response procedures and flag every gap you hit - you'll be the first to find them, and your input drives the rewrites.\nAutomate what you repeat. Script recurring triage, enrichment, and reporting tasks. We'll help you build this skill if you don't have it yet.\nRequired Qualifications\nEntry level hands-on experience in security operations, incident response, IT operations, or system administration or equivalent military/government cyber experience\nWorking knowledge of network protocols and Windows and Linux fundamentals\nFamiliarity with SIEM and EDR concepts and the ability to investigate events using them\nUnderstanding of common attack techniques and exposure to the MITRE ATT&CK framework\nClear, concise written communication - your investigation notes will be read by senior staff and government customers\nGenuine curiosity and the instinct to keep pulling on a thread when something doesn't add up\nActive U.S. Government Top Secret clearance with SCI eligibility and eligibility for SAP access determination\nDoD 8140 CSSP Analyst or IAT Level II certification (Security+ CE or equivalent) at hire or within [6] months\nA degree is not required. Equivalent military, government, or hands-on technical experience is fully accepted.\nPreferred Qualifications\nPrior military cyber experience (17C, 1B4, CTN, 1721, or equivalent) or CPT/CST assignment\nAny scripting exposure - Python, PowerShell, or Bash\nQuery language familiarity - KQL, SPL, or similar\nPrior work in classified DoD or IC environments\nExposure to forensics, malware triage, or detection rule development\nSecurity+, CySA+, GSEC, GCIH, or similar\nActive TS/SCI with polygraph\nWhy This Role\nMost early-career defensive cyber jobs are queue jobs. You close tickets, escalate anything interesting, and learn very little about the systems you're supposedly defending.\nThis team is small enough that you can't be siloed. You'll sit next to the engineers building the enclaves, help deploy the sensors you'll be watching, and see your tuning recommendations go live. When you find a gap during a hunt, you'll be in the room when we decide how to close it.\nWe're hiring at this level specifically to grow people into senior engineers. If that's the trajectory you want, we'll be explicit about what it takes and invest accordingly.\nLogistics\nOnsite in classified spaces; no telework by nature of the role\nHeightened coverage expectations during launches and mission-critical events\nLimited travel, up to 10%\nMust be able to obtain and maintain access to classified facilities; periodic polygraph may be required\nBase Pay Range for:\nCO applicants is $74,537.00 - $104,351.10\nWA applicants is $81,313.00 - $113,837.85Other site ranges may differ\nCulture Statement\nDon’t meet all desired requirements? Studies have shown that some people are less likely to apply to jobs unless they meet every single desired qualification. At Blue Origin, we are dedicated to building an authentic workplace, so if you’re excited about this role but your past experience doesn’t align perfectly with every desired qualification in the job description, we encourage you to apply anyway. You may be just the right candidate for this or other roles.\nExport Control Regulations\nApplicants for employment at Blue Origin must be a U.S. citizen or national, U.S. permanent resident (i.e. current Green Card holder), or lawfully admitted into the U.S. as a refugee or granted asylum.\nBackground Check\nRequired for all positions: Blue’s Standard Background Check\nRequired for Certain Job Profiles: Defense Biometric Identification System (DBIDS) background check if at any time the role requires one to be on a military installation\nRequired for Certain Job Profiles: Drivers who operate Commercial Motor Vehicles with a Gross Vehicle Weight (GVW), Gross Vehicle Weight Rating (GVWR) or combination of power unit and trailer that meets or exceeds 10,001 lbs. and/or transports placardable amounts of hazardous materials by ground in any vehicle on a public road while in commerce, may be subject to additional Federal Motor Carrier Safety Regulations including: Driver Qualification Files, Medical Certification (obtained before onboarding), Road Test, Hours of Service, Drug and Alcohol Testing, vehicle inspection requirements, CDL requirements (if applicable) and hazardous materials transportation/shipping training.\nRequired for certain Job Profiles: Ability to obtain and maintain Merchant Mariner Credential, which includes pre-employment and random drug testing as well as DOT physical\nBenefits\nBenefits include: Medical, dental, vision, basic and supplemental life insurance, paid parental leave, short and long-term disability, 401(k) with a company match of up to 5%, and an Education Support Program.\nStock Options for all regular employees (working at least 20 hours/week)\nPaid Time Off: Up to four (4) weeks per year based on weekly scheduled hours, and up to 14 company-paid holidays.\nDependent on role type and job level, employees may be eligible for benefits and bonuses based on the company's intent to reward individual contributions and enable them to share in the company's results, or other factors at the company's sole discretion. Bonus amounts and eligibility are not guaranteed and subject to change and cancellation. Please check with your recruiter for more details. \nEqual Employment Opportunity\nBlue Origin is proud to be an Equal Opportunity/Affirmative Action Employer and is committed to attracting, retaining, and developing a highly qualified and dedicated work force. Blue Origin hires and promotes people on the basis of their qualifications, performance, and abilities. We support the establishment and maintenance of a workplace that fosters trust, equality, and teamwork. We provide all qualified applicants for employment and employees with equal opportunities for hire, promotion, and other terms and conditions of employment, regardless of their race, color, religion, sex, sexual orientation, gender identity, national origin/ethnicity, age, physical or mental disability, genetic factors, military/veteran status, or any other status or characteristic protected by federal, state, and/or local law. Blue Origin will consider for employment qualified applicants with criminal histories in a manner consistent with applicable federal, state, and local laws, including the Washington Fair Chance Act, the California Fair Chance Act, the Los Angeles Fair Chance in Hiring Ordinance, and other applicable laws. For more information on “Know Your Rights,” please see here.\nAffirmative Action and Disability Accommodation\nApplicants wishing to receive information on Blue Origin’s Affirmative Action Plans, or applicants requiring a reasonable accommodation in order to participate in the application and/or interview process, please contact us at . Please note this is a publicly managed inbox. Please do not include any personal medical information in your request.","description_format":"text","description_chars":10023,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":true,"languages":[]},"benefits":["Life insurance","Parental leave","Stock options"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","C4ISR","Manufacturing","Ground Systems"],"lifecycle":[{"event":"open","at":"2026-09-19T19:03:12Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"Filed H-1B visas in the last two years","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":null,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":19,"band":"cold","label":"Long shot","p_open":1,"p_active":0.428,"p_room":0.44,"age_days":29,"expected_fill_days":29,"reasons":["conf:3","stale_co","velocity","win:tail","crowd:junior,brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":104351,"is_top_pay":false},"html_url":"https://alion.io/job/blue-origin-cyber-defense-analyst","json_url":"https://alion.io/job/blue-origin-cyber-defense-analyst.json","meta":{"generated_at":"2026-10-18T06:11:43Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9317,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3698},"rest":"https://alion.io/mcp/rest/get_company?id=3698"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fblue-origin-cyber-defense-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fblue-origin-cyber-defense-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fblue-origin-cyber-defense-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/blue-origin-cyber-defense-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fblue-origin-cyber-defense-analyst"}]}