Information Security Engineer

Tenable, Inc.•Columbia, MD

6h•$102,500 - $136,500•Hybrid

About The Position

Tenable's InfoSec team is seeking an early-career Security Engineer for its Security Engineering & Architecture group. The role spans cloud security and general security engineering across cloud and non-cloud systems. The engineer will support cloud security operations, contribute to security architecture reviews, and participate in risk assessments and threat modeling while working with architects, engineers, GRC, and TPRM. The position also involves developing foundational awareness of AI and agentic systems and applying it during reviews when relevant.

Requirements

2–3 years of experience in security engineering, cloud security, IT security, or a related technical role; internships and adjacent IT/operations experience count.
Working knowledge of at least one major cloud provider (AWS, Azure, or GCP), including IAM fundamentals, networking basics, and common misconfiguration patterns.
Basic understanding of security architecture review or threat modeling concepts, such as STRIDE and data flow diagrams, or clear aptitude and interest in learning them.
Familiarity with least-privilege access, audit logging, secrets management, avoiding static credentials, and secure configuration baselines.
Ability to read documentation and ask questions across unfamiliar systems, with curiosity across different architectures.
Strong written communication skills for documenting review findings and cloud remediation guidance for technical and non-technical audiences.

Nice To Haves

Exposure to IaC security scanning for Terraform or CloudFormation, or to CNAPP, CSPM, or CIEM platforms.
Hands-on exposure to a formal architecture/design review process, including informally reviewing a peer's system design for security gaps.
Basic familiarity with AI/LLM concepts such as prompts, context windows, tool/function calling, and RAG, and awareness of frameworks such as the OWASP Top 10 for LLM Applications or the NIST AI RMF.
A relevant certification, such as Security+ or an AWS, Azure, or GCP security certification, or equivalent self-directed learning.
Prior exposure to compliance frameworks such as SOC 2, FedRAMP, or ISO 27001 relevant to architecture review sign-off.

Responsibilities

Support day-to-day cloud security operations, including monitoring, triage, and remediation of findings across AWS, Azure, and/or GCP using CNAPP/CSPM tooling.
Contribute to security architecture reviews for new systems, integrations, and vendor onboarding across cloud-hosted, on-premises, and SaaS systems.
Learn the architecture review methodology and progress toward managing reviews from intake through sign-off.
Identify and document misconfigurations, excessive permissions, and insecure IaC patterns in Terraform or CloudFormation, and track remediation through closure.
Participate in risk assessments and threat modeling for new projects, including cloud workloads, internal applications, and third-party integrations.
Assist with IAM/RBAC reviews and least-privilege efforts; flag static credentials, over-broad roles, and audit-logging gaps.
Build familiarity with cloud-hosted LLM services, MCP, and risks associated with agent/tool-calling architectures, and apply that awareness during relevant reviews.
Work cross-functionally with engineering, GRC, and TPRM to advance architecture reviews and cloud findings.

Benefits

Medical insurance
Dental insurance
Vision insurance
Disability insurance
Life insurance
401(k) retirement savings with company match
Employee stock purchase plan
Employee referral program
Flexible spending accounts
Employee Assistance Program (EAP)
Education assistance
Parental leave
Paid time off (PTO)
Company-paid holidays
Health and wellness events
Community programs
Variable compensation, including bonuses for non-sales roles, depending on company and individual performance