Cyber Defense Analyst

About the Role

Blue National Security (BNS) builds and operates space systems for the Intelligence Community and Department of Defense. This role is responsible for continuously watching those systems. The Cyber Defense Analyst will monitor, investigate, and respond across BNS classified enclaves, mission ground systems, and labs, working real events on real national security systems alongside senior engineers. This is a hands-on-keyboard role involving consoles, terminals, and logging data.

Key Responsibilities

• Monitor and triage security events and alerts across SIEM, EDR, network sensors, and audit logs.
• Investigate security incidents by pivoting across host, network, and identity data.
• Serve as first responder during incidents, executing containment steps, preserving evidence, and building timelines.
• Participate in structured hunts, initially alongside senior team members.
• Support audit and insider threat review by performing privileged user activity monitoring and audit log review.
• Provide heightened monitoring coverage during launches, mission operations, and other critical windows.
• Assist with sensor deployment, log source onboarding, and agent rollout across enclaves.
• Tune and improve detections by reducing false positives and proposing new detections.
• Improve response playbooks by flagging gaps during execution.
• Script recurring triage, enrichment, and reporting tasks.

Requirements & Tech Stack

• SIEM
• EDR
• Windows and Linux fundamentals
• Network protocols
• MITRE ATT&CK framework

Qualifications

• Entry-level hands-on experience in security operations, incident response, IT operations, system administration, or equivalent military/government cyber experience.
• Working knowledge of network protocols and Windows and Linux fundamentals.
• Familiarity with SIEM and EDR concepts and the ability to investigate events using them.
• Understanding of common attack techniques and exposure to the MITRE ATT&CK framework.
• Clear, concise written communication.
• Genuine curiosity and the instinct to investigate anomalies.
• Active U.S. Government Top Secret clearance with SCI eligibility and eligibility for SAP access determination.
• DoD 8140 CSSP Analyst or IAT Level II certification (e.g., Security+ CE) at hire or within 6 months.
• A degree is not required; equivalent military, government, or hands-on technical experience is accepted.

Preferred Qualifications

• Prior military cyber experience (e.g., 17C, 1B4, CTN, 1721, or equivalent) or CPT/CST assignment.
• Scripting exposure in Python, PowerShell, or Bash.
• Query language familiarity (e.g., KQL, SPL).
• Prior work in classified DoD or IC environments.
• Exposure to forensics, malware triage, or detection rule development.
• Security+, CySA+, GSEC, GCIH, or similar certifications.
• Active TS/SCI with polygraph.

Logistics

• Onsite in classified spaces; no telework.
• Heightened coverage expectations during launches and mission-critical events.
• Limited travel, up to 10%.
• Must be able to obtain and maintain access to classified facilities; periodic polygraph may be required.

Benefits

• Medical, dental, vision, basic and supplemental life insurance.
• Paid parental leave, short and long-term disability.
• 401(k) with a company match of up to 5%.
• Education Support Program.
• Stock Options for regular employees (working at least 20 hours/week).
• Paid Time Off: Up to four (4) weeks per year.
• Up to 14 company-paid holidays.

Background Check

• Required for all positions: Blue’s Standard Background Check.
• Required for Certain Job Profiles: Defense Biometric Identification System (DBIDS) background check if on a military installation.
• Required for Certain Job Profiles: Drivers operating specific Commercial Motor Vehicles may be subject to additional Federal Motor Carrier Safety Regulations.

Export Control

• Applicants must be a U.S. citizen or national, U.S. permanent resident, or lawfully admitted into the U.S. as a refugee or granted asylum.