Information Security Engineer
Tenable · US - Headquarters - Maryland - Columbia
About this role
**Who is Tenable?** Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65% of the Fortune 500, 50% of the Global 2000, and large government agencies. **Your Role** Tenable’s InfoSec team is looking for a **Security Engineer** to join our **Security Engineering & Architecture** group. This role spans disciplines rather than specializing in one area. You’ll split your time between: - **Securing cloud environments** - **Supporting general security engineering disciplines** across the business (cloud and non-cloud systems) **Your Opportunity** - Support **day-to-day cloud security operations**: monitoring, triage, and remediation of findings across **AWS, Azure, and/or GCP** using **CNAPP/CSPM** tooling. - Contribute to **Security Architecture Reviews** for new systems, integrations, and vendor onboarding (cloud, on-prem, or SaaS). Work with the architects/engineers who own the process—learn the methodology and eventually take reviews from intake to sign-off. - Identify and document **misconfigurations**, **excessive permissions**, and insecure **IaC patterns** (Terraform/CloudFormation), and track remediation through to closure. - Participate in **risk assessments** and **threat modeling** for new projects (cloud workloads, internal applications, and third-party integrations). - Assist with **IAM/RBAC reviews** and **least-privilege** efforts; flag static credentials, over-broad roles, and gaps in audit logging. - Build foundational familiarity with how **AI/agentic systems** intersect with the environment, including cloud-hosted LLM services (**AWS Bedrock, Azure OpenAI, GCP Vertex AI**), **Model Context Protocol (MCP)**, and the risk surface of agent/tool-calling architectures. - Work cross-functionally with **engineering, GRC, and TPRM** to keep architecture reviews and cloud findings moving—this role is a connective thread between teams. **What You’ll Need** - **2–3 years** of experience in security engineering, cloud security, IT security, or a related technical role (internships and adjacent IT/ops experience count). - Working knowledge of at least **one major cloud provider** (**AWS, Azure, or GCP**): IAM fundamentals, networking basics, and common misconfiguration patterns. - Basic understanding of **security architecture review** or **threat modeling** concepts (e.g., STRIDE, data flow diagrams) or strong aptitude and interest in learning them. - Familiarity with core security engineering practices: **least-privilege**, **audit logging**, **secrets management** (no static credentials), and **secure configuration baselines**. - Comfort reading documentation and asking good questions across unfamiliar systems (curiosity > deep specialization). - Strong **written communication** for documenting findings and remediation guidance for technical and non-technical audiences. **And Ideally** - Exposure to **IaC security scanning** (Terraform/CloudFormation) or **CNAPP/CSPM/CIEM** platforms. - Hands-on exposure to a formal architecture/design review process (even informally). - Basic familiarity with **AI/LLM concepts** (prompts, context windows, tool/function calling, RAG) and awareness of frameworks like **OWASP Top 10 for LLM Applications** or **NIST AI RMF**. - A relevant certification (Security+, AWS/Azure/GCP security certs, or similar) or equivalent self-directed learning. - Prior exposure to compliance framework
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.