Bluestaq
Senior Cybersecurity Engineer
Owns the defensive security posture of Bluestaq's space/defense software platforms: running the full vulnerability lifecycle, building MITRE ATT&CK-mapped SIEM detections, leading incident response and post-mortems, applying DISA STIG/NIST RMF compliance, and hardening CI/CD pipelines. Requires Linux/Windows admin, cloud, and scripting experience; TS/SCI clearance may be needed.
- Compensation
- $100K–$155K / yr
- Location
- Colorado Springs
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Full time
- Experience
- 2+ years
- Category
- Security
- Posted
Skills
Must have
- Production experience across the vulnerability lifecycle — scanning, risk-based triage, and driving findings to verified closure
- Hands-on SIEM detection engineering — building and tuning rules mapped to MITRE ATT&CK, beyond running queries
- Real incident response experience — containment, scoping, and writing clear post-mortems with root cause and action items
- Applied DISA STIG and NIST RMF — OS hardening (Linux, Windows), managing POA&Ms, and working in compliance platforms (eMASS, Xacta, or equivalent)
- Endpoint anti-malware / on-access scanning experience — deploying and maintaining coverage across a fleet
- Linux and Windows systems administration in production environments
- Cloud experience — AWS, Google Cloud, Azure, or equivalent
- Scripting and automation — Python, Bash, Go, or similar, plus config management / IaC (Ansible, Terraform, or equivalent)
- Threat-intel-to-detection — consuming external findings and translating them into deployed detection logic
- Security-minded in CI/CD and architecture — flagging design risk and steering developers toward secure practices
- Investigative rigor — dig deep, ask why, and don't settle for surface-level answers
- Strong written and verbal communication with peers, leadership, and cross-functional teams
- Ownership mentality — follow through, document work, and know when to persevere vs. ask for help
- High School Diploma/GED and 8+ years relevant experience, OR Associate degree and 6+ years, OR Bachelor's degree in Cybersecurity/CS/IT or related field and 4+ years, OR Master's degree and 2+ years
Nice to have
- Active TS/SCI clearance — current clearance holders strongly encouraged; Bluestaq will sponsor eligible candidates based on program needs
Full description
Why This Role Matters
The Senior Cybersecurity Engineer at Bluestaq owns the defensive posture of software systems that underpin national security decisions — space domain awareness, satellite command and control, and the infrastructure behind them. This is not a scan-and-report seat. You close vulnerabilities, build detection logic that catches real threats, and lead incident response when things get loud. No playbook required. If you need to be told what to look for, this isn't the right level.
What You Own
- Own the full vulnerability lifecycle — scanning with vulnerability management tools, triage by mission risk, remediation tracking, and verified closure across the fleet.
- Build and tune detection rules in SIEM tools (Splunk, Elastic, ArcSight, Sentinel, etc.) mapped to MITRE ATT&CK tactics relevant to Bluestaq's threat model.
- Serve as an incident responder for security events — contain, help scope, and provide clear status to the IR lead/leadership.
- Deliver written post-mortems with root cause, timeline, and tracked action items following incident closure.
- Maintain endpoint antivirus coverage across the fleet — configure policies, ensure definition currency, and coordinate remediation of flagged systems.
- Apply DISA STIGs to operating systems (Linux, Windows, etc.); document deviations and manage compliance artifacts (POA&Ms) in compliance management platforms (eMASS, Xacta, or equivalent RMF tools).
- Assist in CI/CD pipeline security — provide guidance as far left as possible in the development cycle to ensure developers are generating clean, secure code and catching vulnerabilities before they reach production.
- Review threat intelligence and peer-organization incident disclosures; translate findings into deployed detection logic within a sprint cycle.
What You Bring
Must-Haves
- Production experience across the vulnerability lifecycle — scanning, risk-based triage, and driving findings to verified closure.
- Hands-on SIEM detection engineering — building and tuning rules, mapped to MITRE ATT&CK, beyond running queries.
- Real incident response reps — containment, scoping, and writing clear post-mortems with root cause and action items.
- Applied DISA STIG and NIST RMF — OS hardening (Linux, Windows), managing POA&Ms, and working in compliance platforms (eMASS, Xacta, or equivalent).
- Endpoint anti-malware / on-access scanning experience — deploying and maintaining coverage across a fleet.
- Linux and Windows systems Administration in production environments.