Blue Team

Blue Team Engineer Jobs

3 jobs found

1mo ago

Senior Cybersecurity Engineer

Blue Origin Denver, CO

Denver, CO

1mo ago Closed

$134k - $203k/yr Full time Senior Aws Govcloud Azure Government

This position is no longer accepting applications (closed Oct 21, 2026).

Job Description

Blue Origin’s Blue National Security organization is seeking a Senior Cybersecurity Engineer to design, harden, and secure classified enclaves, mission ground systems, and labs. The role focuses on practical cybersecurity engineering, RMF accreditation support, vulnerability remediation, and incident response activities in support of national security missions.

Responsibilities

Implement security architecture across classified enclaves, mission ground systems, and lab environments, including network segmentation, identity and access management, endpoint hardening, logging and audit, and encryption at rest and in transit.
Author and maintain SSPs, security control implementation statements, risk assessments, and POA&Ms.
Guide systems through RMF to achieve ATO and ATC, and sustain compliance through continuous monitoring.
Conduct vulnerability scanning and drive remediation, manage patching, support log review and audit reduction, and triage security events with the enterprise SOC.
Participate in an on-call rotation.
Investigate, contain, and document incidents, and coordinate corrective actions to closure with system owners.
Build scripting and tooling to make compliance evidence, STIG application, and reporting repeatable rather than manual.
Collaborate with program engineers and system administrators to deliver secure systems on mission schedules.
Mentor junior engineers and analysts, contributing to team standards, baselines, and accreditation playbooks.

Requirements

Bachelor’s degree in a technical discipline (Computer Science, Cybersecurity, Computer/Electrical Engineering, or similar) or equivalent experience.
6+ years of hands-on cybersecurity engineering experience.
Direct experience implementing and sustaining security controls on classified systems in DoD or IC environments.
Working experience with RMF control implementation, SSP and artifact development, POA&M remediation, and continuous monitoring.
Hands-on depth in at least three of the following: Linux and Windows hardening (STIG/SCAP), network security and segmentation, IAM and PKI, government cloud (AWS GovCloud / Azure Government), SIEM and log analysis, vulnerability management tooling.
Scripting proficiency in Python, PowerShell, and Bash for automation of security operations and compliance tasks.
Active U.S. Government Top Secret clearance with SCI eligibility and eligibility for SAP access determination.
DoD 8140 IAT/IAM Level II certification (Security+ CE or equivalent) at hire.

Technologies

Python, PowerShell, Bash
Linux, Windows
STIG, SCAP
IAM, PKI
AWS GovCloud, Azure Government
SIEM
RMF
SSP, POA&M, STIG application
Terraform, Ansible, Puppet
JSIG
ICD 503/705
NIST SP 800-53, NIST SP 800-171

Benefits

Medical, dental, vision
Basic and supplemental life insurance
Paid parental leave
Short and long-term disability
401(k) with a company match of up to 5%
Education Support Program
Stock Options for all regular employees working at least 20 hours/week
Paid Time Off: up to four (4) weeks per year based on weekly scheduled hours
Up to 14 company-paid holidays

Logistics

Primarily onsite in classified spaces, with limited telework by nature of the work.
Travel up to 10–15% to other Blue Origin sites and customer facilities.
On-call rotation participation, with occasional extended hours to support mission-critical events and incident response.
Ability to obtain and maintain access to classified facilities; periodic polygraph may be required.

Application Process

Applications will be accepted on an ongoing basis until the requisition is closed.

Base Pay Range

CO applicants: USD 133,500.00 - 186,898.95
WA applicants: USD 145,188.00 - 203,263.20

Preferred Qualifications

Prior ISSO or ISSE role on SAP/SAR programs.
Working knowledge of JSIG, ICD 503/705, and NIST SP 800-53 / 800-171.
Experience standing up and accrediting new classified enclaves, labs, or facilities.
Infrastructure-as-code and configuration management experience (Terraform, Ansible, Puppet).
Cross-domain solution implementation or accreditation support.
Detection engineering, threat hunting, or incident response experience.
Active TS/SCI with polygraph and SAP Eligible.

Background Check

Required for all positions: Blue’s Standard Background Check.
May be required for certain job profiles: Defense Biometric Identification System (DBIDS) background check if the role requires presence on a military installation.
May be required for certain job profiles for drivers operating Commercial Motor Vehicles that meet specified GVW/GVWR thresholds and/or transport placardable hazardous materials by ground in commerce, subject to additional Federal Motor Carrier Safety Regulations.
May be required for certain job profiles: ability to obtain and maintain Merchant Mariner Credential, including pre-employment and random drug testing and a DOT physical.

Export Control Regulations

Applicants for employment at Blue Origin must be a U.S. citizen or national, U.S. permanent resident (current Green Card holder), or lawfully admitted into the U.S. as a refugee or granted asylum.

View full job page →

1mo ago

Staff Application Security Engineer - Blue Team

CVS Health Sacramento, CA

Sacramento, CA

1mo ago Closed

$130k - $261k/yr Full time Application Security Blue Team Cloud Platforms

This position is no longer accepting applications (closed Oct 17, 2026).

Job Description

Defend cloud and application environments at scale with CVS Health. In this onsite role in Sacramento, you will design and run defensive application and cloud security controls, strengthen security governance, and improve incident readiness through automation, playbooks, and continuous operational improvements.

What you’ll do

Design, implement, and maintain defensive security controls across applications, cloud platforms, data systems, and network environments.
Develop and enforce enterprise-wide application and data security standards, policies, and best practices.
Embed security controls into SDLC processes, CI/CD pipelines, and deployment automation frameworks.
Lead security architecture reviews and help ensure alignment with organizational security objectives.
Establish security governance frameworks that improve confidentiality, integrity, availability, and resiliency.
Partner with Engineering, Infrastructure, Architecture, and Business teams to support secure-by-design practices.
Monitor, detect, investigate, and respond to security events, vulnerabilities, threats, and incidents.
Lead vulnerability assessments, remediation planning, risk prioritization, and validation across application and data platforms.
Design, evaluate, and optimize defensive controls across cloud-native, hybrid, and on-premises environments.
Conduct security assessments, perform threat modeling, and run architecture reviews to identify and mitigate risks.
Implement advanced security solutions across multi-cloud, colocation, and enterprise environments.
Support a rotational on-call schedule, including off-hours, nights, weekends, and holidays for a 24x7 operational environment.
Lead security incident response activities including investigation, containment, eradication, recovery, and post-incident reviews.
Develop and continuously improve incident response, detection, escalation, and recovery playbooks to strengthen readiness and cyber resilience.
Mentor and coach engineers on secure coding practices, security engineering principles, and defensive operations.
Research emerging threats, vulnerabilities, and security technologies; evaluate and recommend new defensive tools and platforms.
Automate security operations using code and Security-as-Code principles to improve efficiency and scalability.
Contribute to long-term security strategy, architecture roadmaps, and technology planning; define security objectives and KPIs.
Partner with leadership to prioritize security investments and risk reduction activities, including cyber resilience, redundancy, business continuity, and recovery capabilities.

Required qualifications

7+ years of experience in security engineering, application security, cloud security, or defensive security operations.
3+ years securing modern cloud platforms including AWS, Azure, and GCP.
3+ years with Docker, Kubernetes, Infrastructure-as-Code, and Security-as-Code methodologies.
3+ years experience with one or more programming or scripting languages: Python, Java, C#, JavaScript, Shell, or PowerShell.
3+ years experience in networking, identity management, authentication, authorization, and threat mitigation techniques.

Technologies you’ll work with

AWS, Azure, GCP
Docker, Kubernetes
Infrastructure-as-Code, Security-as-Code
Python, Java, C#, JavaScript, Shell, PowerShell

Benefits

Medical, dental, and vision coverage
Paid time off
Retirement savings options
Wellness programs
Comprehensive benefits package designed to support the physical, emotional, and financial well-being of colleagues and their families

Pay range and incentives

USD 130,295 - 260,590 per year. This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to base pay, and includes an award target in the company’s equity award program.

Education

Bachelor’s degree from an accredited college or university, or equivalent combination of education and relevant work experience (High School Diploma/GED plus 4 years of related experience).

Other details

Application window closes on: 09/22/2026
Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state and local laws.

View full job page →

2mo ago

Staff Security Engineer, Security Operations

ServiceNow Mountain View, CA

Mountain View, CA

2mo ago Closed

Full time Agent Agent Orchestration Agentic Systems

This position is no longer accepting applications (closed Sep 13, 2026).

Job Description

Level up your security impact with autonomous, AI-driven SOC capabilities. In this Staff Security Engineer role on ServiceNow’s Moveworks Security team, you will design and implement incident response and proactive threat hunting powered by multi-agent frameworks and Model Context Protocol (MCP). The work is highly engineering-focused, with opportunities to architect resilient automation that helps corporate systems become “automation-ready,” while partnering across Security Engineering, DevOps, DevSecOps, Compliance, Cloud, and Infrastructure.

Location: Mountain View, CA (onsite).
Minimum experience: 5 years.

Responsibilities

Build and orchestrate agentic security workflows: move beyond basic tool configuration to develop, code, design, and research advanced framework-level approaches for chaining MCP servers and AI agents.
Stand up proactive threat hunting: architect and scale a proactive threat hunting program from scratch.
Close the security feedback loop: create a high-signal feedback loop between the Blue Team and ServiceNow’s internally developed AI Red Team Agent.
Partner across engineering and compliance: collaborate with IT, Security Engineering, DevOps, DevSecOps, Compliance, Cloud, and Infrastructure teams to ensure corporate systems are natively automation-ready.
Own the incident response engineering roadmap: drive the end-to-end incident response lifecycle (Detection, Triage, Containment, Recovery) and replace traditional SOAR workflows with resilient, agentic orchestration.
Escalation for complex incidents: serve as a high-tier technical escalation point for active, complex incidents.
Prove reliability with simulation testing: design, execute, and validate automated simulation tests to demonstrate that agentic workflows and detection pipelines trigger reliably against real-world attack behaviors.

Requirements

U.S. Citizenship Required: must meet strict compliance/FedRAMP criteria.
Experience: 8–10 years in Security Operations, Systems Engineering, or DevSecOps (minimum 5 years of highly relevant engineering experience required).
Cross-functional mastery: 3–5 years of proven experience working closely across Cloud Infrastructure, DevOps, DevSecOps, Compliance, and IT.
AI and agentic fluency: deep familiarity with modern LLM agent frameworks, including active research into application, performance trade-offs, and behavioral guardrails.
Automation engineering: high proficiency in Python and software engineering principles.
Cloud and infrastructure depth: hands-on architectural familiarity with AWS security ecosystems (IAM, CloudTrail, GuardDuty) and containerized environments (Kubernetes/EKS).
FedRAMP and trust awareness: communication skills and security compliance maturity to translate framework controls into automated, code-driven evidence generation pipelines.
Team and collaboration dynamics: high-autonomy, high-collaboration mindset.

Technologies

Python, Model Context Protocol (MCP), LLM agent frameworks, MCP servers, AWS security ecosystems, IAM, CloudTrail, GuardDuty, Kubernetes, EKS, SOAR.

Work Persona / Location Notes

Work personas (flexible, remote, or required in office) are assigned based on work nature and assigned work location.
To determine eligibility, ServiceNow may confirm the distance between your primary residence and the closest ServiceNow office using a third-party service.

View full job page →

Blue Team Engineer Jobs

Senior Cybersecurity Engineer

Staff Application Security Engineer - Blue Team

Staff Security Engineer, Security Operations

Get Blue Team Engineer Jobs alerts