Tenable Engineer - Secret | DC Metro

Optiv + ClearShark•Washington DC, DC

About The Position

Optiv + ClearShark is seeking a Tenable Cybersecurity Engineer to design, deploy, configure, integrate, tune, and support Tenable capabilities across enterprise networks, endpoints, email, cloud, SaaS, identity, and other supported environments. The engineer will work with security operations, network and cloud engineering, identity, incident response, and customer stakeholders to improve threat detection, investigation, and response. The role calls for strong experience in security monitoring, network detection and response, incident triage, packet and log analysis, security-tool integration, and operational security engineering. The successful candidate will be comfortable working in regulated or federal environments and translating Tenable detections, behavioral analytics, and AI-assisted investigations into actionable security outcomes. Responsibilities include managing Tenable platform components across on-premises, hybrid-cloud, and cloud-hosted environments; developing detection and investigation use cases; analyzing security telemetry; collaborating on incident response; integrating Tenable with enterprise security tools; producing technical documentation and reports; advising on architecture and telemetry coverage; validating response actions; and supporting compliance and audit activities. The position requires an active Secret clearance at hire, a relevant bachelor’s degree or an equivalent combination of education, training, certifications, and experience, and at least five years of relevant cybersecurity experience and experience with Tenable or comparable technologies. The job posting describes work in the DC Metro area and says remote work may be possible where applicable.

Requirements

Active Secret clearance at the time of hire.
Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline; an equivalent combination of education, military training, certifications, and relevant experience may be considered.
At least 5 years of relevant cybersecurity engineering, security operations, network-security, threat-detection, incident-response, or security-platform administration experience.
At least 5 years of experience with Tenable or comparable technologies in one or more listed categories, including NDR, XDR, EDR, NSM, SIEM, UEBA, SOAR, email security, cloud security, or identity-threat detection.
Hands-on experience deploying, configuring, tuning, administering, and troubleshooting Tenable or similar enterprise cybersecurity platforms.
Strong knowledge of enterprise networking and network security, including TCP/IP, OSI, DNS, DHCP, HTTP/S, SMTP, TLS, VPNs, routing, switching, VLANs, firewalls, proxies, segmentation, and packet capture and analysis.
Experience analyzing network traffic, packet captures, security logs, endpoint telemetry, authentication events, and cloud audit data for incident detection and investigation.
Experience with security operations such as alert triage, investigation, threat hunting, incident escalation, containment, evidence collection, reporting, and post-incident lessons learned.
Experience integrating security tools with SIEM and SOAR platforms such as Microsoft Sentinel, Splunk, IBM QRadar, Elastic, ServiceNow, Microsoft Defender, Palo Alto Cortex XSOAR, or similar platforms.
Working knowledge of API integrations, REST APIs, JSON, webhooks, authentication methods, syslog, and log-forwarding concepts.
Experience with Linux administration and command-line troubleshooting; familiarity with virtual machines, virtualization platforms, and common enterprise operating systems.
Ability to develop basic automation or integration scripts using Python, PowerShell, Bash, or a comparable language.
Strong written and verbal communication skills, including documenting technical designs, explaining investigation findings, and briefing technical and nontechnical stakeholders.
Strong analytical judgment to distinguish normal business activity from potentially malicious or anomalous behavior.
Ability to explain AI-assisted or behavior-based detections in understandable operational and risk-based terms.
Ability to work independently and coordinate effectively across SOC, infrastructure, cloud, identity, network, and leadership stakeholders.
Strong attention to detail in configuration management, change control, evidence collection, documentation, and production implementation.
Ability to manage competing priorities, support time-sensitive incidents, and maintain disciplined escalation procedures.
Commitment to secure engineering, operational rigor, continuous improvement, and customer mission success.

Nice To Haves

Current Tenable certification.
Experience with Tenable / NETWORK, / EMAIL, / ENDPOINT, / CLOUD, and / IDENTITY; Cyber AI Analyst investigations; Threat Visualizer; and autonomous-response capabilities and policy governance.
Experience with Microsoft security technologies, including Microsoft Defender XDR, Microsoft Defender for Endpoint, Defender for Office 365, Entra ID, Microsoft Sentinel, Azure, and Microsoft 365.
Experience with cloud-security monitoring and engineering in AWS, Azure, Azure Government, AWS GovCloud, Google Cloud Platform, or hybrid-cloud environments.
Familiarity with identity-security technologies and authentication telemetry, including Active Directory, Microsoft Entra ID, privileged access management, SSO, MFA, federation, conditional access, and identity threat detection.
Experience in Department of Defense, intelligence community, federal civilian, defense-industrial-base, or other regulated environments.
Knowledge of NIST RMF, NIST SP 800-53, NIST SP 800-171, NIST Cybersecurity Framework, DoD STIGs, CMMC, FedRAMP, FISMA, DFARS, or other federal cybersecurity requirements.
Experience supporting classified, air-gapped, disconnected, constrained-connectivity, or highly segmented environments.
Familiarity with MITRE ATT&CK, cyber threat intelligence, threat hunting methodologies, intrusion analysis, and adversary tactics, techniques, and procedures.
Relevant certifications such as CISSP, CISM, Security+, CySA+, CEH, GCIH, GCIA, GCED, CCNA, CCNP, PCNSE, AWS Security Specialty, Azure Security Engineer Associate, SC-200, SC-100, Splunk Core Certified Power User, or comparable credentials.

Responsibilities

Design, deploy, configure, administer, and maintain Tenable platform components in on-premises, hybrid-cloud, and cloud-hosted enterprise environments.
Configure and tune Tenable detections, behavioral models, alerting thresholds, autonomous-response policies, and investigative workflows to align with organizational threat models, risk tolerance, architecture, and security operations processes.
Lead or support implementation of Tenable network, email, endpoint, cloud, SaaS, and identity-security capabilities.
Conduct platform health checks, capacity planning, sensor or collector placement assessments, upgrades, configuration validation, and troubleshooting.
Analyze model breaches, alerts, anomalies, incident investigations, device behavior, network traffic, and related telemetry to identify malicious or suspicious activity, false positives, and tuning opportunities.
Collaborate with SOC analysts, incident responders, threat hunters, network engineers, cloud teams, system administrators, and identity teams to investigate and contain security events.
Develop and maintain threat-detection, triage, investigation, enrichment, and escalation use cases across enterprise security domains.
Configure, test, and maintain integrations between Tenable and SIEM, SOAR, EDR/XDR, ticketing, vulnerability-management, threat-intelligence, identity, cloud-security, and log-management platforms.
Use APIs, syslog, webhooks, automation, and scripting to exchange security events, enrich detections, automate workflows, and support incident response.
Provide technical analysis of network, endpoint, email, cloud, SaaS, and identity telemetry for security monitoring and incident response.
Develop standard operating procedures, implementation guides, architecture diagrams, operational runbooks, escalation procedures, and knowledge-base articles.
Produce technical reports and briefings describing detected activity, risk, root cause, response actions, platform health, tuning recommendations, and security trends.
Participate in security architecture reviews and advise stakeholders on telemetry coverage, sensor placement, segmentation, visibility gaps, logging requirements, and detection strategy.
Validate Tenable response actions and ensure automated or semi-automated responses are governed, tested, approved, and documented before production use.
Maintain awareness of emerging threats, attacker techniques, security-tool capabilities, AI-assisted defense concepts, and relevant MITRE ATT&CK techniques.
Support compliance and audit activities by maintaining required security documentation, evidence, configuration records, operating procedures, and implementation artifacts.