Information Security Engineer

Tenable•Columbia, MD

23d•Hybrid

About The Position

Tenable is seeking an early-career Security Engineer for its Security Engineering & Architecture group. The role spans cloud security operations and broader security engineering across cloud and non-cloud systems. The engineer will support cloud findings and remediation, contribute to security architecture reviews, risk assessments, and threat modeling, and collaborate with engineering, GRC, and TPRM teams. The role also includes building foundational familiarity with AI and agentic systems and applying that awareness during reviews when relevant.

Requirements

2–3 years of experience in security engineering, cloud security, IT security, or a related technical role; internships and adjacent IT/operations experience count.
Working knowledge of at least one major cloud provider (AWS, Azure, or GCP), including IAM fundamentals, networking basics, and common misconfiguration patterns.
Basic understanding of security architecture review or threat modeling concepts, such as STRIDE and data flow diagrams, or aptitude and interest in learning them.
Familiarity with least-privilege access, audit logging, secrets management, and secure configuration baselines.
Comfort reading documentation and asking questions across unfamiliar systems.
Strong written communication skills for documenting review findings and cloud remediation guidance for technical and non-technical audiences.

Nice To Haves

Exposure to IaC security scanning for Terraform or CloudFormation, or CNAPP/CSPM/CIEM platforms.
Hands-on exposure to a formal architecture/design review process, including informal peer system design reviews for security gaps.
Basic familiarity with AI/LLM concepts such as prompts, context windows, tool/function calling, and RAG, and awareness of the OWASP Top 10 for LLM Applications or the NIST AI RMF.
A relevant certification, such as Security+ or an AWS, Azure, or GCP security certification, or equivalent self-directed learning.
Prior exposure to compliance frameworks such as SOC 2, FedRAMP, or ISO 27001 relevant to architecture review sign-off.

Responsibilities

Monitor, triage, and help remediate cloud security findings across AWS, Azure, and/or GCP using CNAPP/CSPM tooling.
Contribute to security architecture reviews for new systems, integrations, and vendor onboarding, across cloud-hosted, on-premises, and SaaS systems; learn the review methodology and eventually handle reviews from intake to sign-off.
Identify and document misconfigurations, excessive permissions, and insecure IaC patterns in Terraform or CloudFormation, and track remediation through closure.
Participate in risk assessments and threat modeling for new projects involving cloud workloads, internal applications, or third-party integrations.
Assist with IAM/RBAC reviews and least-privilege efforts; identify static credentials, over-broad roles, and audit logging gaps.
Build familiarity with cloud-hosted LLM services, MCP, and the risk surface of agent/tool-calling architectures, and apply that awareness during relevant reviews.
Work cross-functionally with engineering, GRC, and TPRM to advance architecture reviews and cloud findings.

Benefits

Medical insurance
Dental insurance
Vision insurance
Disability insurance
Life insurance
401(k) retirement savings with company match
Employee stock purchase plan
Employee referral program
Flexible spending accounts
Employee Assistance Program (EAP)
Education assistance
Parental leave
Paid time off (PTO)
Company-paid holidays
Health and wellness events
Community programs
Variable compensation, including bonuses for non-sales roles, depending on company and individual performance