Tenable Engineer - Secret | DC Metro

Optiv • Washington, DC

8d

About The Position

Optiv + ClearShark is seeking a Tenable Cybersecurity Engineer to design, deploy, configure, integrate, tune, and operationally support Tenable capabilities across enterprise networks, endpoints, email, cloud, SaaS, identity, and other supported environments. The engineer will partner with security operations, network and cloud engineering, identity, incident response, and customer stakeholders to improve threat detection, investigation, and response. The role involves network detection and response, security monitoring, incident triage, packet and log analysis, security-tool integration, and operational security engineering, including translating Tenable detections, behavioral analytics, and AI-assisted investigations into actionable security outcomes.

The engineer will implement and maintain Tenable capabilities in on-premises, hybrid-cloud, and cloud-hosted environments; develop and tune detection and investigation workflows; analyze security telemetry; support incident response; and integrate Tenable with enterprise security technologies. The role also includes platform health and capacity work, technical documentation and reporting, architecture guidance, validation and governance of response actions, and support for compliance and audit activities. An active Secret clearance is required at the time of hire.

Requirements

• Active Secret clearance at time of hire.
• Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline; an equivalent combination of education, military training, certifications, and relevant experience may be considered.
• At least 5 years of relevant cybersecurity engineering, security operations, network-security, threat-detection, incident-response, or security-platform administration experience.
• At least 5 years of experience with Tenable or comparable technologies in one or more of NDR, XDR, EDR, NSM, SIEM, UEBA, or SOAR.
• Hands-on experience deploying, configuring, tuning, administering, and troubleshooting Tenable or similar enterprise cybersecurity platforms.
• Strong knowledge of enterprise networking and network security, including TCP/IP, OSI, DNS, DHCP, HTTP/S, SMTP, TLS, VPNs, routing, switching, VLANs, firewalls, proxies, segmentation, and packet capture and analysis.
• Experience analyzing network traffic, packet captures, security logs, endpoint telemetry, authentication events, and cloud audit data for incident detection and investigation.
• Experience with security operations processes, including alert triage, investigation, threat hunting, incident escalation, containment, evidence collection, reporting, and post-incident lessons learned.
• Experience integrating security tools with SIEM and SOAR platforms, such as Microsoft Sentinel, Splunk, IBM QRadar, Elastic, ServiceNow, Microsoft Defender, Palo Alto Cortex XSOAR, or similar platforms.
• Working knowledge of API integrations, REST APIs, JSON, webhooks, syslog, authentication methods, and log forwarding.
• Experience with Linux administration and command-line troubleshooting; familiarity with virtual machines, virtualization platforms, and common enterprise operating systems.
• Ability to develop basic automation or integration scripts using Python, PowerShell, Bash, or a comparable language.
• Strong written and verbal communication skills, including documenting technical designs, explaining investigation findings, and briefing technical and nontechnical stakeholders.
• Strong analytical judgment and ability to distinguish normal business activity from potentially malicious or anomalous behavior.
• Ability to explain AI-assisted or behavior-based detections in understandable operational and risk-based terms.
• Ability to work independently and coordinate effectively across SOC, infrastructure, cloud, identity, network, and leadership stakeholders.
• Attention to detail in configuration management, change control, evidence collection, documentation, and production implementation.
• Ability to manage competing priorities, support time-sensitive incidents, and maintain disciplined escalation procedures.
• Commitment to secure engineering, operational rigor, continuous improvement, and customer mission success.

Nice To Haves

• Current Tenable certification.
• Experience with Tenable / NETWORK, / EMAIL, / ENDPOINT, / CLOUD, and / IDENTITY; Cyber AI Analyst investigations; Threat Visualizer; and autonomous-response capabilities and policy governance.
• Experience with Microsoft security technologies, including Microsoft Defender XDR, Microsoft Defender for Endpoint, Defender for Office 365, Entra ID, Microsoft Sentinel, Azure, and Microsoft 365.
• Experience with cloud-security monitoring and engineering in AWS, Azure, Azure Government, AWS GovCloud, Google Cloud Platform, or hybrid-cloud environments.
• Familiarity with identity-security technologies and authentication telemetry, including Active Directory, Microsoft Entra ID, privileged access management, SSO, MFA, federation, conditional access, and identity threat detection.
• Experience in Department of Defense, intelligence community, federal civilian, defense-industrial-base, or other regulated environments.
• Knowledge of NIST RMF, NIST SP 800-53, NIST SP 800-171, NIST Cybersecurity Framework, DoD STIGs, CMMC, FedRAMP, FISMA, DFARS, or other federal cybersecurity requirements.
• Experience supporting classified, air-gapped, disconnected, constrained-connectivity, or highly segmented environments.
• Familiarity with MITRE ATT&CK, cyber threat intelligence, threat-hunting methodologies, intrusion analysis, and adversary tactics, techniques, and procedures.
• Relevant certifications such as CISSP, CISM, Security+, CySA+, CEH, GCIH, GCIA, GCED, CCNA, CCNP, PCNSE, AWS Security Specialty, Azure Security Engineer Associate, SC-200, SC-100, Splunk Core Certified Power User, or comparable credentials.

Responsibilities

• Design, deploy, configure, administer, and maintain Tenable platform components in on-premises, hybrid-cloud, and cloud-hosted enterprise environments.
• Configure and tune detections, behavioral models, alert thresholds, autonomous-response policies, and investigative workflows to align with threat models, risk tolerance, architecture, and security operations processes.
• Lead or support implementation of Tenable network, email, endpoint, cloud, SaaS, and identity-security use cases.
• Perform platform health checks, capacity planning, sensor or collector placement assessments, system upgrades, configuration validation, and troubleshooting.
• Analyze model breaches, alerts, anomalies, incident investigations, device behavior, network traffic, and related security telemetry to identify malicious or suspicious activity, false positives, and tuning opportunities.
• Collaborate with SOC analysts, incident responders, threat hunters, network engineers, cloud teams, system administrators, and identity teams to investigate and contain security events.
• Develop and maintain detection, triage, investigation, enrichment, and escalation use cases across enterprise security domains.
• Configure, test, and maintain Tenable integrations with SIEM, SOAR, EDR/XDR, ticketing, vulnerability-management, threat-intelligence, identity, cloud-security, and log-management platforms.
• Use APIs, syslog, webhooks, automation, and scripting to exchange security events, enrich detections, automate workflows, and support incident response.
• Support security monitoring and incident response with technical analysis of network, endpoint, email, cloud, SaaS, and identity telemetry.
• Develop standard operating procedures, implementation guides, architecture diagrams, operational runbooks, escalation procedures, and knowledge-base articles.
• Produce technical reports and briefings on detected activity, risk, root cause, response actions, platform health, tuning recommendations, and security trends.
• Participate in security architecture reviews and advise stakeholders on telemetry coverage, sensor placement, segmentation, visibility gaps, logging requirements, and detection strategy.
• Validate Tenable response actions and ensure automated or semi-automated responses are governed, tested, approved, and documented before production use.
• Maintain awareness of emerging threats, attacker techniques, security-tool capabilities, AI-assisted defense concepts, and relevant MITRE ATT&CK techniques.
• Support compliance and audit activities by maintaining required security documentation, evidence, configuration records, procedures, and implementation artifacts.

Benefits

• Work/life balance.
• Professional training resources.
• Creative problem-solving and the ability to tackle unique, complex projects.
• Volunteer opportunities through “Optiv Chips In,” which encourages employees to volunteer and engage with their teams and communities.
• The ability and technology necessary to productively work remotely/from home, where applicable.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level