Leading Tier 1 Consultancy is seeking a highly experienced Senior Tenable Engineer to support a financial services end client in strengthening their vulnerability management and threat exposure capabilities. This role will focus on optimizing the client’s Tenable platform, improving security posture, and embedding scalable, automated security practices across complex enterprise environments.
Key Responsibilities
* Lead the design, deployment, and optimization of Tenable Vulnerability Management (VM) solutions (e.g., Tenable.io / Tenable.sc / Tenable One).
* Develop and mature enterprise-wide vulnerability management processes aligned to financial services regulatory and risk requirements.
* Conduct advanced threat exposure analysis and risk-based prioritization to reduce attack surface across on-prem and cloud environments.
* Integrate Tenable with:
o SIEM platforms (e.g., Splunk, QRadar, Sentinel) for real-time visibility and correlation.
o CMDB systems (e.g., ServiceNow) for asset normalization and remediation tracking.
o DSPM and cloud security tools for data and cloud workload visibility.
o Security orchestration and automation pipelines (SOAR/DevSecOps) to enable automated remediation workflows.
* Build executive-level and operational reporting dashboards tailored to risk, compliance, and audit stakeholders.
* Support regulatory and compliance initiatives (e.g., PCI-DSS, ISO 27001, NIST, FCA-aligned frameworks).
* Provide technical leadership, mentoring internal teams, and establishing best practices for vulnerability lifecycle management.
Required Experience
* Proven hands-on expertise with Tenable platforms in large, regulated enterprise environments.
* Deep knowledge of vulnerability management lifecycle, risk-based prioritization, and remediation governance.
* Strong experience integrating Tenable with SIEM, CMDB, cloud platforms (AWS/Azure/GCP), and automation tooling.
* Experience operating within financial services or other highly regulated industries.
* Solid understanding of network architecture, cloud security, endpoint security, and identity-related exposure risks.
* Ability to translate technical findings into risk-focused business outcomes.
Desirable
* Experience with exposure management and attack surface management capabilities.
* Scripting/automation experience (e.g., Python, PowerShell, API integrations).
* Familiarity with DevSecOps pipelines and Infrastructure as Code environments.
This will be an inside IR35 role working via umbrella company, so only apply if you are able to consider contract roles working on this basis.