The trick is to find a company that has to take security seriously, and then that company will have some meaningful blue-team work even though there is an ocean of tool running, compliance paperwork.

So for example, Microsoft, Google, Amazon, they all have good product security teams that do meaningful stuff, where "meaningful stuff" is defined as:

- design and development of security features and defense mechanisms

- design reviews, code reviews

- innovative tool development (as opposed to just running)

- development and improvement of Big data/statistical analysis

You just have to find a team actually doing that, and not a team doing compliance stuff. But there are such teams.