Senior Cybersecurity Engineer – Vulnerability Management & SIEM

Xcel Engineering•Oak Ridge, TN

About The Position

XCEL Engineering is seeking a highly skilled Senior Cybersecurity Engineer to support enterprise cybersecurity operations across complex, mission-critical computing environments. The role administers, maintains, and enhances enterprise vulnerability management, security monitoring, and event logging capabilities to protect the confidentiality, integrity, and availability of information systems. The position supports both classified and unclassified environments and requires expertise with Tenable Security Center, enterprise SIEM platforms, vulnerability assessment, log management, and security automation, alongside knowledge of federal cybersecurity requirements. The engineer will manage vulnerability scanning platforms and infrastructure, assess and prioritize vulnerabilities, troubleshoot scanning issues, collaborate on remediation, and produce reports and metrics. The role also administers SIEM and centralized logging platforms; designs and troubleshoots log collection architectures and data pipelines; develops ETL processes; integrates and analyzes security logs; and improves event searches, correlation rules, dashboards, and reporting. The engineer works with technical teams and vendors to resolve issues and improve security visibility, detection, investigation, and response. The work takes place in an inside office environment and involves extended computer use and potentially long periods sitting at a desk. Employment is contingent on passing a background check and drug screening before starting; employees are also subject to random drug screenings. XCEL Engineering is an E-Verify employer and an Equal Opportunity/Affirmative Action Employer.

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Engineering, or a related technical discipline, or an equivalent combination of education and relevant experience.
Significant professional experience in cybersecurity engineering, vulnerability management, security monitoring, or enterprise security operations.
Hands-on experience administering and troubleshooting Tenable Security Center (Tenable.sc) or comparable enterprise vulnerability management platforms.
Strong understanding of vulnerability scanning methodologies, credentialed scanning, vulnerability validation, risk assessment, and remediation processes.
Hands-on experience administering, configuring, or supporting enterprise SIEM and centralized logging solutions.
Experience with log collection, ingestion pipelines, event processing, indexing, parsing, and security event analysis.
Knowledge of ETL processes, data integration, and security log normalization.
Experience supporting security monitoring, incident response, threat analysis, or security investigations.
Familiarity with NIST SP 800-53, particularly Audit and Accountability (AU) controls, and federal cybersecurity compliance requirements.
Experience troubleshooting complex technical issues across enterprise operating systems, networks, applications, and security technologies.
Ability to develop or maintain scripts and automated workflows using Python, PowerShell, Bash, or similar scripting languages.
Strong analytical, problem-solving, technical documentation, and communication skills.
Ability to work effectively with multidisciplinary technical teams and communicate cybersecurity risks to stakeholders.

Nice To Haves

U.S. citizenship with an active Department of Defense (DoD) TS, Department of Energy (DOE) Q, or equivalent security clearance.
Bachelor's degree in computer science, information assurance, or a related technical field with 7 or more years of relevant experience.
Experience supporting cybersecurity operations within DoD, DOE, or other federal government environments.
Experience working within classified computing environments or multiple security enclaves.
Advanced knowledge of Tenable Security Center, Nessus scanners, scan policy development, and vulnerability reporting.
Experience with enterprise SIEM platforms such as Splunk, Elastic Security, IBM QRadar, or similar technologies.
Experience designing or maintaining custom log ingestion pipelines, data transformations, and automated security workflows.
Familiarity with Linux and Windows system administration, enterprise networking, and infrastructure security.
Experience with security automation, REST APIs, system integrations, and scripting.
Knowledge of NIST Risk Management Framework (RMF), continuous monitoring, and federal information security requirements.
Experience supporting threat hunting, detection engineering, security analytics, or incident response activities.
Relevant industry certifications such as CompTIA Security+, CySA+, CASP+/SecurityX, CISSP, GIAC, or equivalent cybersecurity credentials.

Responsibilities

Administer, configure, maintain, and optimize enterprise vulnerability management platforms, primarily Tenable Security Center (Tenable.sc).
Manage vulnerability scanning infrastructure, including scanner deployment, scan policies, scheduling, credential management, plugin updates, and operational troubleshooting.
Conduct vulnerability assessments across servers, networks, applications, and infrastructure systems.
Analyze scan results, validate findings, identify false positives, assess severity, and prioritize remediation based on risk and operational impact.
Troubleshoot failed scans, scanner connectivity and credential issues, performance limitations, and detection anomalies.
Collaborate with system administrators, infrastructure teams, and security personnel on remediation strategies, vulnerability tracking, and verification of corrective actions.
Work with vendors, including Tenable, to resolve technical issues and validate software updates or detection improvements.
Develop vulnerability reports, dashboards, and metrics communicating risks, remediation progress, and program effectiveness.
Administer, configure, maintain, and enhance enterprise SIEM and centralized security logging platforms.
Design, implement, and troubleshoot log collection architectures, event collectors, processing pipelines, indexing systems, and data ingestion workflows.
Develop and maintain ETL processes to collect, normalize, transform, and integrate security event data from multiple enterprise sources.
Integrate logs from operating systems, network devices, applications, security tools, and infrastructure platforms.
Monitor and troubleshoot log ingestion failures, parsing errors, data quality issues, and system performance concerns.
Collaborate with system owners and cybersecurity teams to align logging and auditing practices with NIST SP 800-53 Audit and Accountability (AU) controls across classified enclaves.
Identify logging coverage gaps and implement enhancements for threat detection, incident investigation, and security monitoring.
Develop and optimize security event searches, correlation rules, dashboards, and reporting for threat hunting and incident response.
Coordinate with software and technology vendors to resolve SIEM issues and improve logging capabilities.