Senior Cybersecurity Engineer – Vulnerability Management & SIEM

COMPANY OVERVIEW

XCEL Engineering, Inc. is an award-winning small business that provides trusted information technology, engineering, consulting and project management solutions and services to federal agencies and organizations. Originally founded in 1971 by professional engineers at the University of Tennessee, XCEL was acquired in 2003 by U.S. Army and Navy veterans and in 2023 became a MartinFed company.

XCEL Engineering is a part of IT Lab Partners (ITLP) which was created to support a leading research facility in the East Tennessee region in recruiting the best and the brightest technical talent. Considering joining our impressive team today!

JOB OVERVIEW

We are seeking a highly skilled and experienced Senior Cybersecurity Engineer - Vulnerability & Security Monitoring to support enterprise cybersecurity operations across complex, mission-critical computing environments. This position is responsible for administering, maintaining, and enhancing enterprise vulnerability management, security monitoring, and event logging capabilities to ensure the confidentiality, integrity, and availability of information systems.

The ideal candidate will bring extensive hands-on experience with Tenable Security Center, enterprise SIEM platforms, vulnerability assessment, log management, and security automation, along with a strong understanding of federal cybersecurity requirements.

This role requires a technically proficient engineer capable of troubleshooting complex security technologies, analyzing vulnerabilities and security events, developing automated solutions, and collaborating with cross-functional teams to strengthen the organization's overall security posture across classified and unclassified environments.

ESSENTIAL FUNCTIONS

Vulnerability Management & Assessment

• Administer, configure, maintain, and optimize enterprise vulnerability management platforms, primarily Tenable Security Center (Tenable.sc).
• Manage vulnerability scanning infrastructure, including scanner deployment, scan policies, scheduling, credential management, plugin updates, and operational troubleshooting.
• Conduct comprehensive vulnerability assessments across diverse enterprise computing environments, including servers, networks, applications, and infrastructure systems.
• Analyze vulnerability scan results to validate findings, identify false positives, assess severity, and prioritize remediation efforts based on risk and operational impact.
• Troubleshoot failed scans, scanner connectivity issues, credential failures, performance limitations, and detection anomalies.
• Collaborate with system administrators, infrastructure teams, and security personnel to develop remediation strategies, track vulnerabilities, and verify corrective actions.
• Engage directly with vendors, including Tenable, to resolve technical issues, investigate inaccurate findings, and validate software updates or detection improvements.
• Develop vulnerability reports, dashboards, and metrics to communicate security risks, remediation progress, and overall program effectiveness.

Security Information & Event Management (SIEM) / Logging

• Administer, configure, maintain, and enhance enterprise SIEM and centralized security logging platforms.
• Design, implement, and troubleshoot log collection architectures, event collectors, processing pipelines, indexing systems, and data ingestion workflows.
• Develop and maintain ETL (Extract, Transform, Load) processes to collect, normalize, transform, and integrate security event data from multiple enterprise sources.
• Integrate logs from operating systems, network devices, applications, security tools, and infrastructure platforms to improve enterprise security visibility.
• Monitor and troubleshoot log ingestion failures, parsing errors, data quality issues, and system performance concerns.
• Collaborate with system owners and cybersecurity teams to ensure logging and auditing practices align with NIST SP 800-53 Audit and Accountability (AU) controls across multiple classified enclaves.
• Identify gaps in logging coverage and implement enhancements to improve threat detection, incident investigation, and security monitoring.
• Develop and optimize security event searches, correlation rules, dashboards, and reporting capabilities to support threat hunting and incident response.
• Coordinate with software and technology vendors to resolve SIEM platform issues and improve logging capabilities.

Required Qualifications:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Engineering, or a related technical discipline, or an equivalent combination of education and relevant experience.
• Significant professional experience in cybersecurity engineering, vulnerability management, security monitoring, or enterprise security operations.
• Demonstrated hands-on experience administering and troubleshooting Tenable Security Center (Tenable.sc) or comparable enterprise vulnerability management platforms.
• Strong understanding of vulnerability scanning methodologies, credentialed scanning, vulnerability validation, risk assessment, and remediation processes.
• Hands-on experience administering, configuring, or supporting enterprise SIEM and centralized logging solutions.
• Experience with log collection, ingestion pipelines, event processing, indexing, parsing, and security event analysis.
• Knowledge of ETL processes, data integration, and security log normalization.
• Experience supporting security monitoring, incident response, threat analysis, or security investigations.
• Familiarity with NIST SP 800-53, particularly Audit and Accountability (AU) controls, and federal cybersecurity compliance requirements.
• Experience troubleshooting complex technical issues across enterprise operating systems, networks, applications, and security technologies.
• Ability to develop or maintain scripts and automated workflows using Python, PowerShell, Bash, or similar scripting languages.
• Strong analytical, problem-solving, technical documentation, and communication skills.
• Ability to work effectively with multidisciplinary technical teams and communicate cybersecurity risks to stakeholders.

Preferred Qualifications:

• US Citizen with an active Department of Defense (DoD) TS, Department of Energy (DOE) Q security clearance or equivalent.
• Bachelors degree in computer science, information assurance or related technical field with 7+ years of relevant experience.
• Experience supporting cybersecurity operations within Department of Defense (DoD), Department of Energy (DOE), or other federal government environments.
• Experience working within classified computing environments or multiple security enclaves.
• Advanced knowledge of Tenable Security Center, Nessus scanners, scan policy development, and vulnerability reporting.
• Experience with enterprise SIEM platforms such as Splunk, Elastic Security, IBM QRadar, or similar technologies.
• Experience designing or maintaining custom log ingestion pipelines, data transformations, and automated security workflows.
• Familiarity with Linux and Windows system administration, enterprise networking, and infrastructure security.
• Experience with security automation, REST APIs, system integrations, and scripting.
• Knowledge of NIST Risk Management Framework (RMF), continuous monitoring, and federal information security requirements.
• Experience supporting threat hunting, detection engineering, security analytics, or incident response activities.
• Relevant industry certifications such as CompTIA Security+, CySA+, CASP+/SecurityX, CISSP, GIAC, or equivalent cybersecurity credentials.

PHYSICAL REQUIREMENTS & ENVIRONMENTAL CONDITIONS

• Inside office environment.
• Working on a computer for long periods of time.
• May involve long period of sitting at a desk.

OTHER DUTIES

This job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice.

Xcel Engineering is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regards to race, color, religion, religious creed, gender, sexual orientation, gender identity, gender expression, transgender, pregnancy, marital status, national origin, ancestry, citizenship status, age, disability, protected Veteran Status, genetics or any other characteristics protected by applicable federal, state or local law.

All positions at Xcel Engineering, Inc. are contingent upon passing both a background check and drug screening prior to a start date and are subject to random drug screenings during the employment period. In addition, Xcel Engineering is an E-Verify employer.