Blue Team

Blue Team Cybersecurity Jobs

3 jobs found

Today

Senior Cybersecurity Engineer

Blue Origin Denver, CO

Denver, CO

Today

$134k - $203k/yr Full time Senior Aws Govcloud Azure Government

Apply Now

Job Description

Blue Origin’s Blue National Security organization is building and securing classified enclaves, mission ground systems, and labs that support national security operations. In this role, you will engineer security controls end to end, help move systems through RMF for accreditation, and strengthen day-to-day defenses through vulnerability management, event triage, and incident support.

Role focus

Implement security architecture across classified enclaves, mission ground systems, and lab environments, including network segmentation, identity and access management, endpoint hardening, logging and audit, and encryption at rest and in transit.
Author and maintain SSPs, security control implementation statements, risk assessments, and POA&Ms.
Drive systems through RMF to achieve ATO and ATC, then maintain compliance through continuous monitoring.
Conduct vulnerability scanning and remediation, perform patch management, support log review and audit reduction, and triage security events alongside the enterprise SOC.
Investigate, contain, and document incidents, then drive corrective actions to closure with system owners.
Participate in an on-call rotation.
Build scripting and tooling to make compliance evidence, STIG application, and reporting repeatable rather than manual.
Collaborate with program engineers and system administrators to deliver secure systems on mission schedules.
Mentor junior engineers and analysts, and contribute to team standards, baselines, and accreditation playbooks.

Qualifications

Bachelor’s degree in a technical discipline (Computer Science, Cybersecurity, Computer/Electrical Engineering, or similar) or equivalent experience.
6+ years of hands-on cybersecurity engineering experience.
Direct experience implementing and sustaining security controls on classified systems in DoD or IC environments.
Working knowledge of RMF control implementation, SSP and artifact development, POA&M remediation, and continuous monitoring.
Hands-on depth in at least three of: Linux and Windows hardening (STIG/SCAP), network security and segmentation, IAM and PKI, government cloud (AWS GovCloud / Azure Government), SIEM and log analysis, vulnerability management tooling.
Scripting proficiency (Python, PowerShell, Bash) to automate security operations and compliance tasks.
Active U.S. Government Top Secret clearance with SCI eligibility and eligibility for SAP access determination.
DoD 8140 IAT/IAM Level II certification (Security+ CE or equivalent) at hire.

Technologies

Python, PowerShell, Bash
Linux, Windows
STIG, SCAP
IAM, PKI
AWS GovCloud, Azure Government
SIEM, RMF
SSP, POA&M
STIG application
Terraform, Ansible, Puppet
JSIG
ICD 503/705
NIST SP 800-53, NIST SP 800-171

Location and logistics

Denver, CO (onsite), primarily onsite in classified spaces with limited telework due to the nature of the work.
Travel up to 10–15% to other Blue Origin sites and customer facilities.
On-call rotation participation, with occasional extended hours to support mission-critical events and incident response.
Must be able to obtain and maintain access to classified facilities; periodic polygraph may be required.

Base pay range

CO applicants: $133,500.00 - $186,898.95 (yearly)
WA applicants: $145,188.00 - $203,263.20 (yearly)

Benefits

Medical, dental, vision
Basic and supplemental life insurance
Paid parental leave
Short and long-term disability
401(k) with a company match of up to 5%
Education Support Program
Stock Options for all regular employees (working at least 20 hours/week)
Paid Time Off: up to four (4) weeks per year based on weekly scheduled hours
Up to 14 company-paid holidays

Application details

Applications will be accepted on an ongoing basis until the requisition is closed.

Preferred qualifications

Prior ISSO or ISSE role on SAP/SAR programs.
Working knowledge of JSIG, ICD 503/705, and NIST SP 800-53 / 800-171.
Experience standing up and accrediting new classified enclaves, labs, or facilities.
Infrastructure-as-code and configuration management (Terraform, Ansible, Puppet).
Cross-domain solution implementation or accreditation support.
Detection engineering, threat hunting, or incident response experience.
Active TS/SCI with polygraph, SAP Eligible.

Background check and eligibility

Required for all positions: Blue’s Standard Background Check.
Required for certain job profiles: DBIDS background check if the role requires being on a military installation.
Required for certain job profiles: additional requirements may apply for drivers operating certain commercial motor vehicles and/or transporting placardable hazardous materials.
Required for certain job profiles: ability to obtain and maintain a Merchant Mariner Credential, including pre-employment and random drug testing and a DOT physical.
Export control regulations: applicants must be a U.S. citizen or national, U.S. permanent resident, or lawfully admitted as a refugee or granted asylum.

View full job page →

3d ago

Staff Application Security Engineer - Blue Team

CVS Health Sacramento, CA

Sacramento, CA

3d ago

$130k - $261k/yr Full time Application Security Blue Team Cloud Platforms

Apply Now

Job Description

CVS Health is hiring a Staff Application Security Engineer (Blue Team) to strengthen defensive security across applications, cloud platforms, data systems, and network environments. In this role, you will help monitor and respond to security events, improve incident readiness through repeatable playbooks, and advance security through automation, governance, and secure development practices.

What you’ll do

Design, implement, and maintain defensive security controls across applications, cloud platforms, data systems, and network environments.
Develop and enforce enterprise-wide application and data security standards, policies, and best practices.
Embed security controls into SDLC processes, CI/CD pipelines, and deployment automation frameworks.
Lead security architecture reviews and ensure alignment with organizational security objectives.
Establish security governance frameworks that improve confidentiality, integrity, availability, and resiliency.
Partner with Engineering, Infrastructure, Architecture, and Business teams to apply secure-by-design practices across products and services.
Act as a trusted advisor and technical leader for Application Security, Cloud Security, and Secure Development practices.
Influence technical decision-making and security strategy across multiple teams and business units.
Monitor, detect, investigate, and respond to security events, vulnerabilities, threats, and incidents.
Lead vulnerability assessments, remediation planning, risk prioritization, and validation across application and data platforms.
Design, evaluate, and optimize defensive controls across cloud-native, hybrid, and on-premises environments.
Conduct security assessments, threat modeling exercises, and architecture reviews to identify and mitigate risks.
Implement advanced security solutions across multi-cloud, colocation, and enterprise environments.
Participate in a rotational on-call schedule, including off-hours, nights, weekends, and holidays, supporting a 24x7 operational environment.
Lead security incident response activities including investigation, containment, eradication, recovery, and post-incident reviews.
Develop, maintain, and continuously improve incident response, detection, escalation, and recovery playbooks.
Drive operational improvements that strengthen incident readiness and cyber resilience.
Mentor and coach engineers on secure coding practices, security engineering principles, and defensive operations.
Provide guidance to development and operational teams on security best practices and emerging threats.
Support training initiatives that improve security maturity across the organization.
Research emerging threats, vulnerabilities, attack techniques, and security technologies.
Evaluate and recommend new security tools, platforms, and defensive capabilities.
Automate security operations using code and Security-as-Code principles to improve efficiency and scalability.
Improve threat detection, monitoring, alerting, and response capabilities through innovation and continuous improvement.
Contribute to long-term security strategy, architecture roadmaps, and technology planning initiatives.
Define and drive enterprise security objectives and key performance indicators, partnering with leadership to prioritize security investments and risk reduction activities.
Develop standards and practices that improve cyber resilience, redundancy, business continuity, and recovery capabilities.

Required qualifications

7+ years of experience in security engineering, application security, cloud security, or defensive security operations.
3+ years of experience securing modern cloud platforms including AWS, Azure, and GCP.
3+ years of experience with Docker, Kubernetes, Infrastructure-as-Code, and Security-as-Code methodologies.
3+ years of experience in one or more programming or scripting languages including Python, Java, C#, JavaScript, Shell, or PowerShell.
3+ years of experience in networking, identity management, authentication, authorization, and threat mitigation techniques.

Technologies

AWS, Azure, GCP
Docker, Kubernetes
Infrastructure-as-Code, Security-as-Code
Python, Java, C#, JavaScript, Shell, PowerShell

Benefits

Medical, dental, and vision coverage
Paid time off
Retirement savings options
Wellness programs
Comprehensive benefits package designed to support the physical, emotional, and financial well-being of colleagues and their families

Preferred qualifications

Experience designing and operating defensive security controls within cloud-native, containerized, and distributed application environments.
Experience implementing data protection controls and supporting regulatory and compliance requirements including GDPR, CCPA, or similar frameworks.
Demonstrated experience designing and implementing enterprise-scale security controls and security automation solutions.
Deep understanding of networking, software-defined networking (SDN), zero-trust architectures, and cloud security models.
Experience performing threat modeling, security architecture reviews, and secure design assessments.
Ability to develop and interpret network, sequence, application architecture, and data flow diagrams.
Experience with compliance and security frameworks such as NIST, PCI DSS, HIPAA, HITRUST, ISO 27001, SOC 2, or CSA.
Experience securing enterprise data platforms, analytics environments, and data warehouses including Snowflake and similar technologies.
Experience defining and implementing cyber resilience, business continuity, backup, redundancy, and recovery strategies.
Relevant industry certifications such as CISSP, CCSP, GSEC, GIAC, AWS Security Specialty, Azure Security Engineer Associate, or equivalent.

Compensation and location

Location: Sacramento, CA (onsite)
Salary range: USD 130,295 - 260,590 per year
Eligible for a CVS Health bonus, commission, or short-term incentive program in addition to the base pay range listed above
Equity award program includes an award target

Education

Bachelor’s degree from an accredited college or university, or equivalent combination of education and relevant work experience (High School Diploma/GED plus 4 years of related experience)

Additional information

Application window closes on: 09/22/2026
Qualified applicants with arrest or conviction records will be considered in accordance with federal, state, and local laws

View full job page →

1mo ago

Staff Security Engineer, Security Operations

ServiceNow Mountain View, CA

Mountain View, CA

1mo ago Closed

Full time Agent Agent Orchestration Agentic Systems

This position is no longer accepting applications (closed Sep 13, 2026).

Job Description

Move security operations forward with automation. In ServiceNow’s Moveworks Security team, this Staff Agentic Security Engineer role focuses on building autonomous, AI-driven defense capabilities that enhance SOC effectiveness. You will help replace traditional SOAR workflows with resilient, agentic orchestration that improves detection, response, and continuous validation.

Onsite in Mountain View, CA and designed for engineers who want to architect real outcomes: incident response lifecycle automation, proactive threat hunting, and reliable simulation testing that proves agent workflows and detection pipelines trigger against real-world attack behaviors.

What you’ll do

Build advanced AI orchestration: Go beyond basic tool configuration by building, coding, designing, and researching framework-level approaches for chaining MCP servers and AI agents.
Scale proactive threat hunting: Architect and grow a proactive threat hunting program from scratch.
Strengthen Blue Team and AI Red Team collaboration: Create a feedback loop between the Blue Team and ServiceNow’s internally developed AI Red Team Agent.
Partner across engineering and compliance: Work as a strategic engineering partner with IT, Security Engineering, DevOps, DevSecOps, Compliance, Cloud, and Infrastructure teams to ensure corporate systems are “automation-ready.”
Own incident response engineering: Build and maintain an end-to-end incident response roadmap across Detection, Triage, Containment, and Recovery, replacing traditional SOAR workflows with agentic orchestration.
Lead high-stakes escalations: Serve as a top-tier technical escalation point for active, complex incidents.
Validate with automated simulation testing: Design, execute, and validate automated simulation tests to systematically prove agentic workflows and detection pipelines trigger reliably against real-world attack behaviors.

What you bring

U.S. Citizenship required: Must meet strict compliance and FedRAMP criteria.
Experience: 8–10 years in Security Operations, Systems Engineering, or DevSecOps. Minimum 5 years of highly relevant engineering experience required.
Cross-functional mastery: 3–5 years of proven collaboration track record across multidisciplinary teams including Cloud Infrastructure, DevOps, DevSecOps, Compliance, and IT.
AI and agentic fluency: Deep familiarity with modern LLM agent frameworks, including active research into application, performance trade-offs, and behavioral guardrails.
Automation engineering: Strong proficiency in Python and software engineering principles.
Cloud and infrastructure depth: Hands-on architectural familiarity with AWS security ecosystems including IAM, CloudTrail, and GuardDuty, plus containerized environments such as Kubernetes and EKS.
FedRAMP and trust awareness: Ability to communicate and translate framework controls into automated, code-driven evidence generation pipelines.
Collaboration mindset: High-autonomy and high-collaboration approach.

Technologies you’ll work with

Python
Model Context Protocol (MCP)
LLM agent frameworks
MCP servers
AWS security ecosystems: IAM, CloudTrail, GuardDuty
Kubernetes, EKS
SOAR

Work persona and office eligibility

ServiceNow assigns work personas (flexible, remote, or required in office) based on the nature of work and assigned work location. To determine eligibility, ServiceNow may confirm the distance between your primary residence and the closest ServiceNow office using a third-party service.

View full job page →

Blue Team Cybersecurity Jobs

Senior Cybersecurity Engineer

Staff Application Security Engineer - Blue Team

Staff Security Engineer, Security Operations

Get Blue Team Cybersecurity Jobs alerts