Cyber Defense Analyst II

BLUE ORIGIN

. Monitor and triage security events and alerts across SIEM, EDR, network sensors, and audit logs .

Posted 10/30/2026full-timeUnited StatesJuniorMid-Level💰 $90,934 - $138,880 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security operations and incident response, with a strong focus on monitoring, investigation, and automation of security events. Holds an active U.S. Government Top Secret clearance and possesses relevant certifications to ensure compliance and effectiveness in classified environments.

Highest-signal resume keywords

Security OperationsIncident ResponseSIEM and EDR ConceptsMITRE ATT&CK FrameworkDoD 8140 CSSP Analyst Certification

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Network ProtocolsWindows FundamentalsLinux FundamentalsScripting with PythonScripting with PowerShellScripting with BashKQLSPLForensicsMalware Triage

Soft Skills

Clear Written Communication

Tools & Technologies

SIEMEDRAudit LogsNetwork SensorsSecurity Monitoring Tools

Certifications & Qualifications

DoD 8140 CSSP AnalystIAT Level II CertificationSecurity+ CECySA+GSECGCIH

Industry Keywords

Incident ResponseCybersecurityClassified EnvironmentsMilitary Cyber ExperienceIntelligence Community

Tech Stack

Tools & technologies

LinuxPythonTypeScript

About the role

Key responsibilities & impact

Monitor and triage security events and alerts across SIEM, EDR, network sensors, and audit logs
Investigate host, network, and identity data to determine what occurred and document findings
Serve as first responder during incidents
Execute containment steps, preserve evidence, build timelines, and support senior engineers
Participate in structured threat hunts
Perform privileged user activity monitoring and audit log review with Security and Counterintelligence
Provide heightened monitoring during launches, mission operations, and other critical windows
Assist with sensor deployment, log-source onboarding, and agent rollout across classified enclaves
Tune detections, reduce false positives, validate rule coverage, and propose new detections
Execute response procedures and identify playbook gaps
Automate recurring triage, enrichment, and reporting tasks
Work onsite in classified spaces with no telework
Support standard hours with on-call rotation or shift coverage, including nights, weekends, and holidays on a rotating schedule
Travel up to 10%

Requirements

What you’ll need

2+ years of hands-on experience in security operations, incident response, IT operations, or system administration, or equivalent military/government cyber experience
Working knowledge of network protocols and Windows and Linux fundamentals
Familiarity with SIEM and EDR concepts and ability to investigate events using them
Understanding of common attack techniques and exposure to the MITRE ATT&CK framework
Clear, concise written communication
Active U.S. Government Top Secret clearance with SCI eligibility and eligibility for SAP access determination
U.S. citizenship
DoD 8140 CSSP Analyst or IAT Level II certification (Security+ CE or equivalent) at hire or within 6 months
Must be able to obtain and maintain access to classified facilities
Periodic polygraph may be required
A degree is not required; equivalent military, government, or hands-on technical experience is accepted
Preferred: prior military cyber experience or CPT/CST assignment
Preferred: scripting exposure using Python, PowerShell, or Bash
Preferred: familiarity with KQL, SPL, or similar query languages
Preferred: prior work in classified DoD or IC environments
Preferred: exposure to forensics, malware triage, or detection rule development
Preferred: Security+, CySA+, GSEC, GCIH, or similar
Preferred: active TS/SCI with polygraph

Benefits

Comp & perks

Medical, dental, and vision insurance
Basic and supplemental life insurance
Paid parental leave
Short- and long-term disability
401(k) with company match of up to 5%
Education Support Program
Stock options for all regular employees working at least 20 hours/week
Up to four weeks of paid time off per year based on weekly scheduled hours
Up to 14 company-paid holidays
Potential role- and level-dependent bonuses and other benefits
Senior engineering escalation support during on-call rotations
Limited travel, up to 10%