Blue Team Jobs Only: Why We Skip Offensive Security Roles
Blue team jobs get buried. Search for “cybersecurity jobs” and you’ll get pentesters, sales reps and red teamers mixed in with the SOC analysts.
We’ve seen it firsthand. In 17 days, the careers pages we check showed us 2,606 jobs that weren’t security jobs at all, plus 65 offensive ones. A defender would have to wade through all of that.
So we built BlueTeamJobs to do one thing. We list blue team jobs, and only blue team jobs. Here’s why, and how we decide what makes the cut.
What “blue team” means to us
The blue team defends. They watch for attacks and jump in when one gets through. They also make systems harder to break into.
The red team attacks, with permission. They break in so the company can find and fix weak spots.
Both jobs matter. But the skills and tools are different. A great pentester and a great incident responder have very different weeks.
The 10 roles we list
Every job on BlueTeamJobs fits one of these roles:
- SOC analyst
- Incident responder
- Digital forensics (DFIR)
- Threat hunter
- Threat intelligence (CTI) analyst
- Detection engineer
- Security engineer
- Cloud security engineer
- Vulnerability management
- Security operations leadership
If a job doesn’t fit one of these, it doesn’t go on the site.
What we skip
We skip offensive roles, even good ones. That includes:
- Penetration testers
- Red team operators
- Exploit developers
- Vulnerability researchers
We also skip jobs that sit near security but aren’t defense. Sales, marketing and product jobs at security companies don’t make it.
How we keep the board clean
We don’t let anyone dump jobs onto the site. Here’s how a job gets here.
We go to the source
We pull jobs straight from employers’ own careers pages. Right now that’s 105 employers, using their public job boards on Greenhouse, Lever and Ashby. We don’t copy jobs from other job boards. Employers can also post jobs with us directly.
Software sorts every job
Our software reads the title and description of every job. Then it decides if the job is defensive, offensive, or not security at all.
Since we started collecting jobs on October 13, 2026, it has turned away:
- 65 offensive security jobs, such as “Penetration Tester”, “Red Team Operator” and “Vulnerability Researcher”
- 2,606 jobs that weren’t security jobs at all, such as sales account managers
On October 30, 2026, 383 jobs made the cut.
Closed jobs come down
When an employer closes a job, we take it off the site. The page then tells Google the job is gone, so it drops out of search too. 124 jobs have closed since October 13.
That way you don’t waste time applying to a job that’s already filled.
The tricky cases
Some jobs are hard to sort. Here’s how we handle the common ones.
| Job | Do we list it? | Why |
|---|---|---|
| Purple team or threat emulation | No | It’s mostly attack work, even when it helps the defense |
| Vulnerability management | Yes | It finds and fixes weak spots, without attacking |
| Security engineer | Yes, if the work is defensive | Many of these jobs build and run security tools |
| AI red team | No | It’s attack work, just on AI systems |
| Detection engineer | Yes | It writes the rules that catch attackers |
We won’t always get it right. If you spot a job that doesn’t belong, tell us and we’ll fix it.
Why this helps you
If you’re a defender, a focused board saves you time. Every job here is a defense job.
It also means better data. Because we only count blue team jobs, our salary pages and reports show what defenders earn, not an average that mixes in pentesters and sales reps.
And if you’re hiring, your job reaches people who want defense work. You can post a job here.
That’s the whole idea
One kind of job, from the source, taken down when it closes. If that’s the board you’ve been looking for, browse all blue team jobs or start with SOC analyst jobs.
Sources
- BlueTeamJobs job and filter data, October 13 to October 30, 2026
Last verified: October 30, 2026