Tenable Engineer - Secret | DC Metro

Optiv • Washington DC, DC

6d

About The Position

Optiv + ClearShark is seeking a Tenable Cybersecurity Engineer to design, deploy, configure, integrate, tune, and support Tenable capabilities across enterprise networks, endpoints, email, cloud, SaaS, identity, and other environments. The engineer works with security operations, network and cloud engineering, identity, incident response, and customer stakeholders to improve threat detection, investigation, and response. The role involves using Tenable detections, behavioral analytics, and AI-assisted investigations to produce actionable security outcomes in regulated or federal environments.

The position supports Tenable capabilities across on-premises, hybrid-cloud, and cloud-hosted environments, including integrations with SIEM, SOAR, EDR/XDR, cloud, and log-management technologies. The engineer contributes to security monitoring, incident response, security architecture, compliance, and operational documentation.

Requirements

• Active Secret clearance required at time of hire.
• Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline; an equivalent combination of education, military training, certifications, and relevant experience may be considered.
• At least 5 years of relevant cybersecurity engineering, security operations, network-security, threat-detection, incident-response, or security-platform administration experience.
• At least 5 years of experience with Tenable or comparable technologies in one or more listed security categories, including NDR, XDR, EDR, NSM, SIEM, UEBA, SOAR, email security, cloud security, or identity-threat detection.
• Hands-on experience deploying, configuring, tuning, administering, and troubleshooting Tenable or similar enterprise cybersecurity platforms.
• Strong knowledge of enterprise networking and network-security concepts, including TCP/IP, OSI, DNS, DHCP, HTTP/S, SMTP, TLS, VPNs, routing, switching, VLANs, firewalls, proxies, network segmentation, and packet capture and analysis.
• Experience analyzing network traffic, packet captures, security logs, endpoint telemetry, authentication events, and cloud audit data for incident detection and investigation.
• Experience with security operations processes, including alert triage, investigation, threat hunting, incident escalation, containment, evidence collection, reporting, and post-incident lessons learned.
• Experience integrating security tools with SIEM and SOAR platforms, such as Microsoft Sentinel, Splunk, IBM QRadar, Elastic, ServiceNow, Microsoft Defender, Palo Alto Cortex XSOAR, or similar platforms.
• Working knowledge of API-based integrations, REST APIs, JSON, webhooks, authentication methods, syslog, and log-forwarding concepts.
• Experience with Linux administration and command-line troubleshooting; familiarity with virtual machines, virtualization platforms, and common enterprise operating systems.
• Ability to develop basic automation or integration scripts using Python, PowerShell, Bash, or a comparable scripting language.
• Strong written and verbal communication skills, including documenting technical designs, explaining investigation findings, and briefing technical and nontechnical stakeholders.
• Strong analytical judgment and ability to distinguish normal business activity from potentially malicious or anomalous behavior.
• Ability to explain AI-assisted or behavior-based detections in understandable operational and risk-based terms.
• Ability to work independently and coordinate effectively across SOC, infrastructure, cloud, identity, network, and leadership stakeholders.
• Strong attention to detail in configuration management, change control, evidence collection, documentation, and production implementation.
• Ability to manage competing priorities, support time-sensitive incidents, and maintain disciplined escalation procedures.
• Commitment to secure engineering, operational rigor, continuous improvement, and customer mission success.

Nice To Haves

• Current Tenable certification.
• Experience with Tenable / NETWORK, / EMAIL, / ENDPOINT, / CLOUD, and / IDENTITY; Cyber AI Analyst investigations; Threat Visualizer; and autonomous-response capabilities and policy governance.
• Experience with Microsoft security technologies, including Microsoft Defender XDR, Microsoft Defender for Endpoint, Defender for Office 365, Entra ID, Microsoft Sentinel, Azure, and Microsoft 365.
• Experience with cloud-security monitoring and engineering in AWS, Azure, Azure Government, AWS GovCloud, Google Cloud Platform, or hybrid-cloud environments.
• Familiarity with identity-security technologies and authentication telemetry, including Active Directory, Microsoft Entra ID, privileged access management, SSO, MFA, federation, conditional access, and identity threat detection.
• Experience in Department of Defense, intelligence community, federal civilian, defense-industrial-base, or other regulated environments.
• Knowledge of NIST RMF, NIST SP 800-53, NIST SP 800-171, NIST Cybersecurity Framework, DoD STIGs, CMMC, FedRAMP, FISMA, DFARS, or other federal cybersecurity requirements.
• Experience supporting classified, air-gapped, disconnected, constrained-connectivity, or highly segmented environments.
• Familiarity with the MITRE ATT&CK framework, cyber threat intelligence, threat hunting methodologies, intrusion analysis, and adversary tactics, techniques, and procedures.
• Relevant certifications such as CISSP, CISM, Security+, CySA+, CEH, GCIH, GCIA, GCED, CCNA, CCNP, PCNSE, AWS Security Specialty, Azure Security Engineer Associate, SC-200, SC-100, Splunk Core Certified Power User, or comparable credentials.

Responsibilities

• Design, deploy, configure, administer, and maintain Tenable platform components in on-premises, hybrid-cloud, and cloud-hosted enterprise environments.
• Tune Tenable detections, behavioral models, alerting thresholds, autonomous-response policies, and investigative workflows to align with organizational threat models, risk tolerance, architecture, and security operations processes.
• Lead or support implementation of Tenable network, email, endpoint, cloud, SaaS, and identity-security use cases.
• Conduct platform health checks, capacity planning, sensor or collector placement assessments, system upgrades, configuration validation, and troubleshooting.
• Analyze Tenable model breaches, alerts, anomalies, investigations, device behavior, network traffic, and related telemetry to identify malicious or suspicious activity, false positives, and tuning opportunities.
• Collaborate with SOC analysts, incident responders, threat hunters, network engineers, cloud teams, system administrators, and identity teams to investigate and contain security events.
• Develop and maintain detection, triage, investigation, enrichment, and escalation use cases across enterprise security domains.
• Configure, test, and maintain integrations between Tenable and SIEM, SOAR, EDR/XDR, ticketing, vulnerability-management, threat-intelligence, identity, cloud-security, and log-management platforms.
• Use APIs, syslog, webhooks, automation, and scripting to exchange security events, enrich detections, automate workflows, and support incident response.
• Provide technical analysis of network, endpoint, email, cloud, SaaS, and identity telemetry for security monitoring and incident response.
• Develop standard operating procedures, implementation guides, architecture diagrams, operational runbooks, escalation procedures, and knowledge-base articles.
• Produce technical reports and briefings on detected activity, risk, root cause, response actions, platform health, tuning recommendations, and security trends.
• Participate in security architecture reviews and advise stakeholders on telemetry coverage, sensor placement, segmentation, visibility gaps, logging requirements, and detection strategy.
• Validate Tenable response actions and ensure automated or semi-automated capabilities are governed, tested, approved, and documented before production use.
• Maintain awareness of emerging threats, attacker techniques, security-tool capabilities, AI-assisted defense concepts, and relevant MITRE ATT&CK techniques.
• Support compliance and audit activities by maintaining security documentation, evidence, configuration records, procedures, and implementation artifacts.

Benefits

• Work/life balance.
• Professional training resources.
• Creative problem-solving and the ability to tackle unique, complex projects.
• Volunteer opportunities through “Optiv Chips In,” which encourages employees to volunteer and engage with their teams and communities.
• The ability and technology necessary to productively work remotely/from home, where applicable.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior