Senior Cybersecurity Engineer – Vulnerability Management & SIEM

Xcel Engineering is seeking a Senior Cybersecurity Engineer to strengthen vulnerability management and security monitoring across both classified and unclassified environments. This role focuses on administering enterprise platforms for vulnerability assessment and centralized security logging, improving event ingestion and analysis, and supporting audit-aligned security posture through reliable reporting and operational troubleshooting.

What you’ll be doing

• Administer, configure, maintain, and optimize enterprise vulnerability management platforms, primarily Tenable Security Center (Tenable.sc).
• Manage vulnerability scanning infrastructure including scanner deployment, scan policies, scheduling, credential management, plugin updates, and operational troubleshooting.
• Perform comprehensive vulnerability assessments across enterprise environments including servers, networks, applications, and infrastructure systems.
• Analyze scan outputs to validate findings, identify false positives, assess severity, and prioritize remediation efforts based on risk and operational impact.
• Troubleshoot failed scans and issues such as scanner connectivity, credential failures, performance limitations, and detection anomalies.
• Collaborate with system administrators, infrastructure teams, and security personnel to develop remediation strategies, track vulnerabilities, and verify corrective actions.
• Work directly with technology vendors (including Tenable) to resolve technical issues, investigate inaccurate findings, and validate software updates or detection improvements.
• Develop vulnerability reports, dashboards, and metrics that communicate security risks, remediation progress, and overall program effectiveness.
• Administer, configure, maintain, and enhance enterprise SIEM and centralized security logging.
• Design, implement, and troubleshoot log collection architectures including event collectors, processing pipelines, indexing systems, and data ingestion workflows.
• Develop and maintain ETL (Extract, Transform, Load) processes to collect, normalize, transform, and integrate security event data from multiple sources.
• Integrate logs from operating systems, network devices, applications, security tools, and infrastructure platforms to improve security visibility.
• Monitor and troubleshoot log ingestion failures, parsing errors, data quality issues, and system performance concerns.
• Ensure logging and auditing practices align with NIST SP 800-53 Audit and Accountability (AU) controls across multiple classified enclaves.
• Identify gaps in logging coverage and implement enhancements to improve threat detection, incident investigation, and security monitoring.
• Develop and optimize security event searches, correlation rules, dashboards, and reporting capabilities to support threat hunting and incident response.
• Coordinate with software and technology vendors to resolve SIEM issues and improve logging capabilities.

What you bring

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Engineering, or a related technical discipline, or an equivalent combination of education and relevant experience.
• Significant professional experience in cybersecurity engineering, vulnerability management, security monitoring, or enterprise security operations.
• Hands-on experience administering and troubleshooting Tenable Security Center (Tenable.sc) or comparable enterprise vulnerability management platforms.
• Strong understanding of vulnerability scanning methodologies, credentialed scanning, vulnerability validation, risk assessment, and remediation processes.
• Hands-on experience supporting enterprise SIEM and centralized logging solutions.
• Experience with log collection, ingestion pipelines, event processing, indexing, parsing, and security event analysis.
• Knowledge of ETL processes, data integration, and security log normalization.
• Experience supporting security monitoring, incident response, threat analysis, or security investigations.
• Familiarity with NIST SP 800-53, especially AU controls, and federal cybersecurity compliance requirements.
• Ability to troubleshoot complex technical issues across operating systems, networks, applications, and security technologies.
• Ability to develop or maintain scripts and automated workflows using Python, PowerShell, Bash, or similar scripting languages.
• Strong analytical, problem-solving, technical documentation, and communication skills.
• Ability to work effectively with multidisciplinary technical teams and communicate cybersecurity risks to stakeholders.

Technologies you’ll work with

• Tenable Security Center (Tenable.sc), Tenable, Nessus scanners
• ETL (Extract, Transform, Load)
• Python, PowerShell, Bash
• Splunk, Elastic Security, IBM QRadar
• NIST SP 800-53

Preferred qualifications

• US Citizen with an active Department of Defense (DoD) TS, Department of Energy (DOE) Q security clearance, or equivalent.
• Bachelor’s degree in computer science, information assurance, or related technical field with 7+ years of relevant experience.
• Experience supporting cybersecurity operations within DoD, DOE, or other federal government environments.
• Experience working within classified computing environments or multiple security enclaves.
• Advanced knowledge of Tenable Security Center, Nessus scanners, scan policy development, and vulnerability reporting.
• Experience with enterprise SIEM platforms such as Splunk, Elastic Security, IBM QRadar, or similar technologies.
• Experience designing or maintaining custom log ingestion pipelines, data transformations, and automated security workflows.
• Familiarity with Linux and Windows system administration, enterprise networking, and infrastructure security.
• Experience with security automation, REST APIs, system integrations, and scripting.
• Knowledge of NIST Risk Management Framework (RMF), continuous monitoring, and federal information security requirements.
• Experience supporting threat hunting, detection engineering, security analytics, or incident response activities.
• Relevant industry certifications such as CompTIA Security+, CySA+, CASP+/SecurityX, CISSP, GIAC, or equivalent.

Work environment

• Inside office environment
• Long periods of computer work
• May involve long periods of sitting at a desk

Location: Oak Ridge, TN (onsite).

Physical requirements & environmental conditions are limited to the tasks described above.

Other duties: This job description is not intended to be a comprehensive listing of all activities, duties, or responsibilities. Duties may change at any time with or without notice.