Information Security Engineer

Your Role:

Tenable's InfoSec team is looking for a Security Engineer to join our Security Engineering & Architecture group. This role was built deliberately to span disciplines rather than specialize in one: you'll split your time between securing our cloud environments and supporting general security engineering disciplines across the business — covering cloud and non-cloud systems alike. If you're early-career but curious across the breadth of InfoSec rather than narrowly focused on one domain, this role is built for you.

Your Opportunity:

• Support day-to-day cloud security operations — monitoring, triage, and remediation of findings across AWS, Azure, and/or GCP environments using CNAPP/CSPM tooling.
• Contribute to Security Architecture Reviews for new systems, integrations, and vendor onboarding — regardless of whether the system in question is cloud-hosted, on-prem, or SaaS. You'll work directly with the architects and engineers who own this process today, learning the methodology and eventually taking reviews from intake to sign-off.
• Help identify and document misconfigurations, excessive permissions, and insecure IaC patterns (Terraform/CloudFormation), and help track remediation through to closure.
• Participate in risk assessments and threat modeling exercises for new projects — applying the same core analysis skills whether the subject is a cloud workload, an internal application, or a third-party integration.
• Assist with IAM/RBAC reviews and least-privilege efforts; flag static credentials, over-broad roles, and gaps in audit logging wherever they appear in the environment.
• Build foundational familiarity with how AI/agentic systems intersect with our environment — cloud-hosted LLM services (AWS Bedrock, Azure OpenAI, GCP Vertex AI), the Model Context Protocol (MCP), and the basic risk surface of agent/tool-calling architectures and apply that awareness during reviews when these systems show up in scope.
• Work cross-functionally with engineering, GRC, and TPRM to keep architecture reviews and cloud findings moving — this role is a connective thread between teams, not a silo.

What You'll Need:

• 2–3 years of experience in a security engineering, cloud security, IT security, or related technical role (internships and adjacent IT/ops experience count).
• Working knowledge of at least one major cloud provider (AWS, Azure, or GCP) — IAM fundamentals, networking basics, and common misconfiguration patterns.
• Basic understanding of security architecture review or threat modeling concepts (e.g., STRIDE, data flow diagrams) — or clear aptitude and interest in learning them.
• Familiarity with core security engineering practices: least-privilege access, audit logging, secrets management (no static credentials), and secure configuration baselines.
• Comfort reading documentation and asking good questions across unfamiliar systems — this role touches a lot of different architectures, so curiosity matters more than deep specialization in any one of them.
• Strong written communication — you'll be documenting review findings and cloud remediation guidance for technical and non-technical audiences alike.

And Ideally:

• Exposure to IaC security scanning (Terraform/CloudFormation) or CNAPP/CSPM/CIEM platforms.
• Some hands-on exposure to a formal architecture/design review process, even informally (e.g., reviewing a peer's system design for security gaps).
• Basic familiarity with AI/LLM concepts — prompts, context windows, tool/function calling, RAG — and awareness of frameworks like the OWASP Top 10 for LLM Applications or the NIST AI RMF.
• A relevant certification (Security+, AWS/Azure/GCP security certs, or similar) or equivalent self-directed learning.
• Prior exposure to compliance frameworks (SOC 2, FedRAMP, ISO 27001) relevant to architecture review sign-off