Note: The job is a remote job and is open to candidates in USA. Propelex Cybersecurity is a leading cybersecurity consulting firm dedicated to helping organizations of all sizes build resilient, mature security programs. They are seeking a skilled Cybersecurity and Network Security Engineer to deliver hands-on security engagements across their client portfolio, implementing and managing various security tools and programs.
Responsibilities
- Configure and manage Palo Alto Networks (PAN-OS, Panorama) and Check Point (SmartConsole) firewalls across client environments
- Implement network segmentation, perimeter controls, and Zero Trust Network Access (ZTNA)
- Optimize firewall rule sets and support lifecycle management for client network security programs
- Deliver remediation recommendations and hands-on implementation support
- Deploy and configure PAM solutions (e.g., CyberArk, BeyondTrust, Delinea) to secure privileged credentials and enforce session monitoring
- Implement SSO, MFA, and RBAC frameworks within client environments
- Integrate IAM ecosystems with directory services to support secure user lifecycle management
- Lead end-to-end deployment and configuration of Tenable One, Tenable.sc (Security Center), and Tenable OT across complex client environments, including on-premises, hybrid, and operational technology (OT/ICS) networks
- Design and implement Tenable scan zone architecture, scanner placement, and credential management to ensure complete asset coverage across IT and OT environments
- Configure and tune Tenable OT for passive and active discovery of industrial control systems (ICS), SCADA devices, and OT assets, ensuring non-disruptive scanning in production OT environments
- Build and manage Tenable.sc dashboards, reports, and assurance report cards (ARCs) tailored to each client's risk appetite and compliance requirements
- Leverage Tenable One's Exposure Management capabilities — including Asset Inventory, Lumin Exposure View, and Attack Path Analysis — to provide clients with prioritized, risk-based remediation guidance
- Establish SLA-driven remediation workflows and vulnerability tracking processes, integrating Tenable data with ticketing systems (e.g., ServiceNow, Jira) where applicable
- Correlate vulnerability findings with current threat intelligence and exploitability data (CVSS, EPSS, Tenable VPR) to prioritize remediation based on actual risk
- Deliver clear executive and technical vulnerability reports, trend analysis, and KPI dashboards for client leadership teams
- Support clients through Tenable platform upgrades, license management, and ongoing health checks to maintain optimal scanner performance
- Deploy, configure, and manage CrowdStrike Falcon across client environments, including Falcon Prevent (NGAV), Falcon Insight (EDR), Falcon Discover, and Falcon Spotlight — tuning prevention policies, exclusions, and sensor deployment at scale
- Implement and optimize SentinelOne Singularity platform, including Deep Visibility, Ranger network discovery, and Storyline-based detection tuning to reduce false positives and improve signal quality
- Build and maintain detection rules, custom IOC-based indicators, and behavioral analytics within CrowdStrike and SentinelOne to identify client-specific threat patterns
- Deploy and administer SIEM platforms — including Splunk Enterprise/Splunk Cloud and Microsoft Sentinel — covering log source onboarding, data normalization, parsing, and field extraction
- Develop and maintain Splunk SPL searches, correlation searches, alerts, and dashboards; build Microsoft Sentinel KQL analytics rules, workbooks, and automation playbooks
- Manage log ingestion pipelines, ensure completeness of coverage across endpoint, network, identity, and cloud log sources, and establish data retention and tiering policies
- Design and implement SOAR playbooks (Splunk SOAR / Palo Alto XSOAR) to automate alert triage, enrichment, and response workflows, reducing mean time to respond (MTTR)
- Conduct structured threat hunting exercises within client environments using XDR telemetry, SIEM data, and threat intelligence feeds to identify undetected adversary activity
- Support client SOC teams with incident response — containing endpoints, collecting forensic artifacts, and producing clear incident timelines and post-incident reports
- Integrate XDR/EDR and SIEM platforms with threat intelligence sources, vulnerability management data, and identity systems to enrich detections and reduce analyst workload
- Assess and harden client Active Directory environments, including Group Policy and tiered administration
- Identify and remediate common AD attack paths (e.g., Kerberoasting, pass-the-hash, DCSync)
- Support Azure AD / Entra ID deployments and Conditional Access policy configuration
Skills
- 7–10 years of progressive experience in cybersecurity and network security engineering or operations
- Extensive hands-on experience implementing and managing Tenable One, Tenable.sc (Security Center), and Tenable OT in enterprise or consulting environments — this is a core requirement
- Deep understanding of Tenable OT architecture, passive/active scanning methodologies, and safe OT scanning practices in ICS/SCADA environments
- Proven ability to build and manage Tenable.sc dashboards, ARCs, and reporting workflows aligned to client compliance frameworks
- Experience with Tenable One Exposure Management, including Lumin, Attack Path Analysis, and asset inventory at scale
- Hands-on experience deploying and administering CrowdStrike Falcon (Prevent, Insight, Discover, Spotlight) and/or SentinelOne Singularity in enterprise environments
- Demonstrated experience with Splunk (SPL, correlation searches, dashboards) and/or Microsoft Sentinel (KQL, analytics rules, workbooks) in a production SOC or consulting context
- Experience building SOAR playbooks for alert automation and incident response workflows (Splunk SOAR, Palo Alto XSOAR, or equivalent)
- Hands-on expertise with Palo Alto Networks and Check Point firewall platforms
- Demonstrated experience implementing PAM and IAM solutions at enterprise scale
- Strong knowledge of Active Directory security, attack techniques, and hardening practices
- Solid understanding of TCP/IP networking, DNS, PKI, VPNs, and cloud networking (AWS, Azure, GCP)
- Active certifications such as CISSP, CISM, GIAC (GCIA, GCFA, GCFE), Tenable Certified Security Engineer (TCSE), CrowdStrike CCFA/CCFR, Splunk Core Certified Power User, or equivalent
- Tenable-specific certifications or documented Tenable implementation experience strongly preferred
- Prior experience in a cybersecurity consulting or MSSP environment
- Familiarity with compliance frameworks including SOC 2, PCI DSS, HIPAA, CMMC, NERC CIP, or ISO 27001
- Experience integrating Tenable and SIEM platforms with ticketing and ITSM systems (ServiceNow, Jira)
- Scripting experience in Python, PowerShell, or Bash for detection engineering, log parsing, or vulnerability management automation
Company Overview