Tenable Engineer - Secret - DC Metro

Optiv Security; Washington (District of Columbia); On-site; USD 120,000 - 190,000; Full time

Job summary

Optiv + ClearShark is seeking a Tenable Cybersecurity Engineer to design, deploy, and manage Tenable capabilities across enterprise networks, endpoints, email, cloud, SaaS, and identity environments. The role requires strong experience in network detection, security monitoring, incident triage, and AI-assisted investigations, with ability to translate detections into actionable outcomes.

You will collaborate with SOC, network, cloud, and identity teams to optimize telemetry, implement use cases,

Qualifications

• Bachelor's degree or equivalent in cybersecurity, IT, CS, or engineering.
• At least 5 years in cybersecurity engineering, security operations, or incident response.
• Experience with Tenable or similar technologies across networks, endpoints, cloud, and identity.

Responsibilities

• Design, deploy, configure, administer, and maintain Tenable components across on-prem, hybrid, and cloud environments.
• Tune detections, thresholds, and investigative workflows to align with threat model and security operations.
• Lead or support Tenable capability implementations across network, email, endpoint, cloud, and identity use cases.
• Perform platform health checks, capacity planning, upgrades, and troubleshooting.
• Analyze Tenable alerts, breaches, anomalies, and telemetry to identify malicious activity and tuning opportunities.
• Collaborate with SOC, incident response, threat hunting, and identity teams to contain events.
• Develop use cases for detection, triage, investigation, enrichment, and escalation across domains.
• Configure and maintain integrations between Tenable and SIEM, SOAR, EDR/XDR, identity, cloud, and log-management platforms.
• Use APIs, syslog, webhooks, and scripting to exchange events and automate workflows.

Skills

Active Secret clearance

5+ years cybersecurity engineering

Security operations

Threat detection

Incident response

Education

Bachelor's degree in cybersecurity/IT/CS/engineering or related field

Tools

Tenable

SIEM

SOAR

EDR/XDR

NDR

Job description

Optiv + ClearShark is looking for a Tenable Cybersecurity Engineer is responsible for the design, deployment, configuration, integration, tuning, and operational support of Tenable capabilities across enterprise networks, endpoints, email, cloud, SaaS, identity, and other supported environments. The engineer will work closely with security operations, network engineering, cloud engineering, identity, incident response, and customer stakeholders to improve threat detection, investigation, and response. This position requires a technically strong cybersecurity professional with experience in network detection and response, security monitoring, incident triage, packet and log analysis, security-tool integration, and operational security engineering. The successful candidate will be comfortable working in regulated or federal environments and will translate Tenable detections, behavioral analytics, and AI-assisted investigations into actionable security outcomes. Tenable capabilities may encompass network, endpoint, email, cloud, SaaS, and identity telemetry, with AI-assisted investigation workflows and integrations to SIEM, SOAR, EDR/XDR, cloud, and log-management technologies.

How you'll make an impact

• Design, deploy, configure, administer, and maintain Tenable platform components within on-premises, hybrid-cloud, and cloud-hosted enterprise environments.
• Configure and tune Tenable detections, behavioral models, alerting thresholds, autonomous-response policies, and investigative workflows to align with the organization's threat model, risk tolerance, architecture, and security operations processes.
• Lead or support implementation of applicable Tenable capabilities, including network, email, endpoint, cloud, SaaS, and identity-security use cases.
• Perform ongoing platform health checks, capacity planning, sensor or collector placement assessments, system upgrades, configuration validation, and technical troubleshooting.
• Analyze Tenable model breaches, alerts, anomalies, incident investigations, device behavior, network traffic, and related security telemetry to identify malicious activity, suspicious behavior, false positives, and opportunities for tuning.
• Collaborate with SOC analysts, incident responders, threat hunters, network engineers, cloud teams, system administrators, and identity teams to investigate and contain security events.
• Develop and maintain use cases for threat detection, triage, investigation, enrichment, and escalation across enterprise security domains.
• Configure, test, and maintain integrations between Tenable and enterprise security technologies, including SIEM, SOAR, EDR/XDR, ticketing, vulnerability-management, threat-intelligence, identity, cloud-security, and log-management platforms.
• Use APIs, syslog, webhooks, automation, and scripting to exchange security events, enrich detections, automate workflows, and support incident-response processes.
• Support security monitoring and incident-response activities by providing deep technical analysis of network, endpoint, email, cloud, SaaS, and identity-related telemetry.
• Develop standard operating procedures, implementation guides, architecture diagrams, operational runbooks, escalation procedures, and knowledge-base articles.
• Produce clear technical reports and briefings that describe detected activity, risk, root cause, response actions, platform health, tuning recommendations, and security trends.
• Participate in security architecture reviews and advise stakeholders on telemetry coverage, sensor placement, segmentation, visibility gaps, logging requirements, and detection strategy.
• Support validation of Tenable response actions and ensure automated or semi-automated response capabilities are appropriately governed, tested, approved, and documented before production use.
• Maintain awareness of emerging threats, attacker techniques, security-tool capabilities, AI-assisted defense concepts, and relevant MITRE ATT&CK techniques.
• Support compliance and audit activities by maintaining security documentation, evidence, configuration records, operating procedures, and implementation artifacts required for the environment.

What we're looking for

• Active Secret clearance required at time of hire.
• Bachelor's degree in cybersecurity, information technology, computer science, engineering, or a related discipline; equivalent combination of education, military training, certifications, and relevant experience may be considered.
• At least 5 years of relevant cybersecurity engineering, security operations, network-security, threat-detection, incident-response, or security-platform administration experience.
• At least 5 years of experience with Tenable or comparable technologies in one or more of the following categories: Network Detection and Response (NDR), Extended Detection and Response (XDR), Endpoint Detection and Response (EDR), Network Security Monitoring (NSM), Security Information and Event Management (SIEM), User and Entity Behavior Analytics (UEBA