Defensive Cybersecurity Engineer/Blue Team

The Defensive Cybersecurity Engineer/Blue Team role supports MITRE’s Defensive Cyber Operations department, combining hands-on defensive operations with AI-enabled cybersecurity research and development to build next-generation protections for mission-critical systems and national infrastructure.

Role Overview

This position blends day-to-day defensive cyber operations with applied cybersecurity engineering and AI-focused development. The work includes improving adversary detection, strengthening network defenses, and enhancing Security Operations Center (SOC) processes, while evaluating emerging AI approaches for defensive cyber missions.

Responsibilities

• Apply cybersecurity expertise and contemporary data science skills to improve adversary detection, network defense, and SOC process quality.
• Develop AI-enabled cybersecurity tooling for anomaly detection, behavioral analytics, malware analysis, and adversary emulation.
• Research and assess emerging AI techniques, including machine learning, deep learning, generative AI, and reinforcement learning, for defensive cyber applicability.
• Use MITRE ATT&CK® to conduct adversary hunts and build tactics, techniques, and procedures (TTP)-based defenses.
• Perform detection engineering by creating security analytics and dashboards in Splunk or Elastic, including integration of new data feeds.
• Automate container environments through continuous integration and continuous deployment (CI/CD).
• Serve as a trusted advisor to the Federal Government.

Requirements

• Typically requires a minimum of 8 years of related experience with a Bachelor’s degree; or 6 years with a Master’s degree; or 3 years with a PhD; or an equivalent combination of related education and work experience.
• Bachelor’s degree in Computer Science, Cybersecurity, Data Science, Applied Mathematics, Statistics, or a related field.
• Significant experience with Splunk and cloud computing.
• Knowledge of cybersecurity operations and cybersecurity principles and their application.
• Experience in at least one of: Security Operations Centers (SOCs), threat hunting, detection engineering, malware analysis, or cyber deception.
• Subject to a government clearance security investigation and must meet eligibility requirements for access to classified information.
• Must have an active Top Secret/SCI with polygraph U.S. Government issued Security Clearance. U.S. citizenship is required to be considered for a security clearance.
• On-site requirement of 5 days per week.

Department Summary

MITRE’s Defensive Cyber Operations department collaborates with cybersecurity engineers across defensive cyber operations, threat hunt, detection engineering, and cyber deception and adversary engagement, with increasing emphasis on artificial intelligence. The goal is to support mission-driven cybersecurity initiatives for government sponsors and to design, implement, and evaluate next-generation defensive capabilities leveraging machine learning, large language models, autonomous systems, and advanced analytics.

Technology Focus

• Splunk
• Elastic
• MITRE ATT&CK®
• CI/CD

Preferred Qualifications

• Experience with Elastic/ELK.
• Experience using MITRE ATT&CK®.
• Experience using or developing AI tools and techniques for defensive cyber operations.

Clearance Requirements

• Minimum required clearance: Top Secret/SCI/Polygraph.
• Must have or obtain, within one year from the date of hire: Top Secret/SCI/Polygraph.

Compensation and Location

• Salary range: USD 158,800 - 238,200 per year
• Salary midpoint compensation range: $158,800 - $198,500 - $238,200 Annual
• Location: Springfield, VA (onsite)