Cloud Security Engineer - IAM, CNAPP & Threat Modeling

VulnU; Columbia (MD); Hybrid; USD 103,000 - 137,000; Full time

Benefits offered by this job

Paid parental leave

Retirement match

Equity

Job summary

Tenable's InfoSec team seeks a Security Engineer to join the Security Engineering Architecture group. You will secure cloud environments, review new systems, and support IaC security across AWS, Azure, and GCP.

This role spans cloud and non-cloud tech, with collaboration across engineering and GRC teams. You will help document findings, support threat modeling, and build familiarity with agent/calling architectures while maintaining a strong focus on least-privilege and audit logging.

Qualifications

• 2–3 years in security engineering, cloud/security IT role.
• Working knowledge of at least one cloud provider (AWS/Azure/GCP).
• Familiarity with security architecture review or threat modeling concepts.
• Comfort with least-privilege, audit logging, and secrets management.
• Strong written communication for documenting findings and remediation guidance.

Responsibilities

• Support day-to-day cloud security operations across AWS/Azure/GCP.
• Contribute to Security Architecture Reviews for systems and vendors.
• Identify misconfigurations, excessive permissions, and insecure IaC patterns.
• Assist with risk assessments and threat modeling for new projects.
• Support IAM/RBAC reviews and audit logging improvements.
• Collaborate cross-functionally with engineering, GRC, and TPRM.

Skills

Cloud security

IAM fundamentals

Threat modeling

IaC security

Audit logging

Least-privilege

Documentation

Tools

Terraform

CloudFormation

CNAPP/CSPM platforms

CIEM

Job description

Tenable's InfoSec team seeks a Security Engineer to join the Security Engineering Architecture group. You will secure cloud environments, review new systems, and support IaC security across AWS, Azure, and GCP.

This role spans cloud and non-cloud tech, with collaboration across engineering and GRC teams. You will help document findings, support threat modeling, and build familiarity with agent/calling architectures while maintaining a strong focus on least-privilege and audit logging.