Your Opportunity:

Tenable Research is seeking a Senior Security Researcher - Cloud Security to join our highly technical product research team working at the core of our cloud security platform.

This is a rare opportunity to join an elite research team and do work that directly shapes our product. In this role, you will define how vulnerabilities in cloud assets are understood, enriched, and remediated. As AI floods production with vulnerabilities, you design the model and system that keeps teams ahead of it.

You will define the foundation for how cloud vulnerabilities are treated across the platform, from reachability and exploitability to effective resolution. Your work will directly shape product direction and set the standard for what handling vulns at scale actually means.

We are looking for an exceptional researcher who can bridge cloud security, application security, and vulnerability management. You are curious, comfortable with ambiguity, and driven to deeply understand how vulnerabilities manifest and how they are fixed across cloud environments and code.

Your Role:

• Own Vulnerability Management Across Tenable's Cloud Security Platform: Define cloud vulnerability management by grounding findings in how exposure is actually created and what resolving it means for organizations. Collaborate with engineering and product teams to introduce the signals and data that validate exploitability and drive remediation. Establish the standard for what separates an actionable finding from a theoretical one.
• Research Exploitability and Risk Context: Research how the security context around a finding affects its real-world risk and what resolving it looks like. Define how these factors shape prioritization and remediation across the platform.
• Lead Remediation Research: Define how vulnerabilities across cloud and code map to the fixes that resolve them, and drive AI innovation in how remediation is understood and delivered at scale. Work with engineering and product to build the capabilities that close the loop from detection to resolution.
• Publish and Present: Share research through technical blogs, reports, and leading industry conferences.

What You'll Need:

• 5+ years of hands-on experience in security research
• Familiarity with real-world vulnerability management: triage, prioritization, remediation, and the gap between CVSS and actual impact
• Strong technical background in cloud platforms (AWS, Azure, GCP), including how vulnerabilities manifest across workloads, services, and code
• Familiarity with application security tooling
• Highly curious, self-driven, and comfortable working in ambiguous, fast-evolving problem spaces
• Strong communication skills, both written and verbal, with the ability to clearly articulate complex technical findings

And Ideally:

• Experience with exploit research, full-chain attack analysis, or CVE-to-fix resolution across complex dependency chains
• Experience leveraging AI and agentic workflows for security research and analysis
• Background in application security, secure code review, or supply chain security
• Hands-on experience with SBOM tooling, container scanning, or software composition analysis pipelines
• Track record of published research, conference talks, or technical blog posts
• Experience working with product teams and delivering value to customers through the product