SIEM Engineer Jobs
SIEM Engineer jobs are open across financial services, healthcare, defense, and enterprise technology, at every level from analyst-track junior roles to senior and principal, with specializations in threat detection, log management, and security automation. Find a role that fits below and apply directly.
Find SIEM Engineer JobsLooking for remote work? View remote SIEM engineer jobs →Overview
Showing 5 of 27+ SIEM Engineer jobs
COMPANY OVERVIEW
XCEL Engineering, Inc. is an award-winning small business that provides trusted information technology, engineering, consulting and project management solutions and services to federal agencies and organizations. Originally founded in 1971 by professional engineers at the University of Tennessee, XCEL was acquired in 2003 by U.S. Army and Navy veterans and in 2023 became a MartinFed company.
XCEL Engineering is a part of IT Lab Partners (ITLP) which was created to support a leading research facility in the East Tennessee region in recruiting the best and the brightest technical talent. Considering joining our impressive team today!
JOB OVERVIEW
We are seeking a highly skilled and experienced Senior Cybersecurity Engineer - Vulnerability & Security Monitoring to support enterprise cybersecurity operations across complex, mission-critical computing environments. This position is responsible for administering, maintaining, and enhancing enterprise vulnerability management, security monitoring, and event logging capabilities to ensure the confidentiality, integrity, and availability of information systems.
The ideal candidate will bring extensive hands-on experience with Tenable Security Center, enterprise SIEM platforms, vulnerability assessment, log management, and security automation, along with a strong understanding of federal cybersecurity requirements.
This role requires a technically proficient engineer capable of troubleshooting complex security technologies, analyzing vulnerabilities and security events, developing automated solutions, and collaborating with cross-functional teams to strengthen the organization's overall security posture across classified and unclassified environments.
ESSENTIAL FUNCTIONS
Vulnerability Management & Assessment
- Administer, configure, maintain, and optimize enterprise vulnerability management platforms, primarily Tenable Security Center (Tenable.sc).
- Manage vulnerability scanning infrastructure, including scanner deployment, scan policies, scheduling, credential management, plugin updates, and operational troubleshooting.
- Conduct comprehensive vulnerability assessments across diverse enterprise computing environments, including servers, networks, applications, and infrastructure systems.
- Analyze vulnerability scan results to validate findings, identify false positives, assess severity, and prioritize remediation efforts based on risk and operational impact.
- Troubleshoot failed scans, scanner connectivity issues, credential failures, performance limitations, and detection anomalies.
- Collaborate with system administrators, infrastructure teams, and security personnel to develop remediation strategies, track vulnerabilities, and verify corrective actions.
- Engage directly with vendors, including Tenable, to resolve technical issues, investigate inaccurate findings, and validate software updates or detection improvements.
- Develop vulnerability reports, dashboards, and metrics to communicate security risks, remediation progress, and overall program effectiveness.
Security Information & Event Management (SIEM) / Logging
- Administer, configure, maintain, and enhance enterprise SIEM and centralized security logging platforms.
- Design, implement, and troubleshoot log collection architectures, event collectors, processing pipelines, indexing systems, and data ingestion workflows.
- Develop and maintain ETL (Extract, Transform, Load) processes to collect, normalize, transform, and integrate security event data from multiple enterprise sources.
- Integrate logs from operating systems, network devices, applications, security tools, and infrastructure platforms to improve enterprise security visibility.
- Monitor and troubleshoot log ingestion failures, parsing errors, data quality issues, and system performance concerns.
- Collaborate with system owners and cybersecurity teams to ensure logging and auditing practices align with NIST SP 800-53 Audit and Accountability (AU) controls across multiple classified enclaves.
- Identify gaps in logging coverage and implement enhancements to improve threat detection, incident investigation, and security monitoring.
- Develop and optimize security event searches, correlation rules, dashboards, and reporting capabilities to support threat hunting and incident response.
- Coordinate with software and technology vendors to resolve SIEM platform issues and improve logging capabilities.
Required Qualifications:
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Engineering, or a related technical discipline, or an equivalent combination of education and relevant experience.
- Significant professional experience in cybersecurity engineering, vulnerability management, security monitoring, or enterprise security operations.
- Demonstrated hands-on experience administering and troubleshooting Tenable Security Center (Tenable.sc) or comparable enterprise vulnerability management platforms.
- Strong understanding of vulnerability scanning methodologies, credentialed scanning, vulnerability validation, risk assessment, and remediation processes.
- Hands-on experience administering, configuring, or supporting enterprise SIEM and centralized logging solutions.
- Experience with log collection, ingestion pipelines, event processing, indexing, parsing, and security event analysis.
- Knowledge of ETL processes, data integration, and security log normalization.
- Experience supporting security monitoring, incident response, threat analysis, or security investigations.
- Familiarity with NIST SP 800-53, particularly Audit and Accountability (AU) controls, and federal cybersecurity compliance requirements.
- Experience troubleshooting complex technical issues across enterprise operating systems, networks, applications, and security technologies.
- Ability to develop or maintain scripts and automated workflows using Python, PowerShell, Bash, or similar scripting languages.
- Strong analytical, problem-solving, technical documentation, and communication skills.
- Ability to work effectively with multidisciplinary technical teams and communicate cybersecurity risks to stakeholders.
Preferred Qualifications:
- US Citizen with an active Department of Defense (DoD) TS, Department of Energy (DOE) Q security clearance or equivalent.
- Bachelors degree in computer science, information assurance or related technical field with 7+ years of relevant experience.
- Experience supporting cybersecurity operations within Department of Defense (DoD), Department of Energy (DOE), or other federal government environments.
- Experience working within classified computing environments or multiple security enclaves.
- Advanced knowledge of Tenable Security Center, Nessus scanners, scan policy development, and vulnerability reporting.
- Experience with enterprise SIEM platforms such as Splunk, Elastic Security, IBM QRadar, or similar technologies.
- Experience designing or maintaining custom log ingestion pipelines, data transformations, and automated security workflows.
- Familiarity with Linux and Windows system administration, enterprise networking, and infrastructure security.
- Experience with security automation, REST APIs, system integrations, and scripting.
- Knowledge of NIST Risk Management Framework (RMF), continuous monitoring, and federal information security requirements.
- Experience supporting threat hunting, detection engineering, security analytics, or incident response activities.
- Relevant industry certifications such as CompTIA Security+, CySA+, CASP+/SecurityX, CISSP, GIAC, or equivalent cybersecurity credentials.
PHYSICAL REQUIREMENTS & ENVIRONMENTAL CONDITIONS
- Inside office environment.
- Working on a computer for long periods of time.
- May involve long period of sitting at a desk.
OTHER DUTIES
This job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice.
Xcel Engineering is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regards to race, color, religion, religious creed, gender, sexual orientation, gender identity, gender expression, transgender, pregnancy, marital status, national origin, ancestry, citizenship status, age, disability, protected Veteran Status, genetics or any other characteristics protected by applicable federal, state or local law.
If you are a qualified individual with a disability or disabled veteran, you have the right to request a reasonable accommodation if you are unable or limited in your ability to use or access Xcel Engineering's current openings as a result of your disability. You can request reasonable accommodations by calling 855.212.1810. Thank you for your interest in Xcel Engineering.
COMPANY OVERVIEW
XCEL Engineering, Inc. is an award-winning small business that provides trusted information technology, engineering, consulting and project management solutions and services to federal agencies and organizations. Originally founded in 1971 by professional engineers at the University of Tennessee, XCEL was acquired in 2003 by U.S. Army and Navy veterans and in 2023 became a MartinFed company.
XCEL Engineering is a part of IT Lab Partners (ITLP) which was created to support a leading research facility in the East Tennessee region in recruiting the best and the brightest technical talent. Considering joining our impressive team today!
JOB OVERVIEW
We are seeking a highly skilled and experienced Senior Cybersecurity Engineer - Vulnerability & Security Monitoring to support enterprise cybersecurity operations across complex, mission-critical computing environments. This position is responsible for administering, maintaining, and enhancing enterprise vulnerability management, security monitoring, and event logging capabilities to ensure the confidentiality, integrity, and availability of information systems.
The ideal candidate will bring extensive hands-on experience with Tenable Security Center, enterprise SIEM platforms, vulnerability assessment, log management, and security automation, along with a strong understanding of federal cybersecurity requirements.
This role requires a technically proficient engineer capable of troubleshooting complex security technologies, analyzing vulnerabilities and security events, developing automated solutions, and collaborating with cross-functional teams to strengthen the organization's overall security posture across classified and unclassified environments.
ESSENTIAL FUNCTIONS
Vulnerability Management & Assessment
- Administer, configure, maintain, and optimize enterprise vulnerability management platforms, primarily Tenable Security Center (Tenable.sc).
- Manage vulnerability scanning infrastructure, including scanner deployment, scan policies, scheduling, credential management, plugin updates, and operational troubleshooting.
- Conduct comprehensive vulnerability assessments across diverse enterprise computing environments, including servers, networks, applications, and infrastructure systems.
- Analyze vulnerability scan results to validate findings, identify false positives, assess severity, and prioritize remediation efforts based on risk and operational impact.
- Troubleshoot failed scans, scanner connectivity issues, credential failures, performance limitations, and detection anomalies.
- Collaborate with system administrators, infrastructure teams, and security personnel to develop remediation strategies, track vulnerabilities, and verify corrective actions.
- Engage directly with vendors, including Tenable, to resolve technical issues, investigate inaccurate findings, and validate software updates or detection improvements.
- Develop vulnerability reports, dashboards, and metrics to communicate security risks, remediation progress, and overall program effectiveness.
Security Information & Event Management (SIEM) / Logging
- Administer, configure, maintain, and enhance enterprise SIEM and centralized security logging platforms.
- Design, implement, and troubleshoot log collection architectures, event collectors, processing pipelines, indexing systems, and data ingestion workflows.
- Develop and maintain ETL (Extract, Transform, Load) processes to collect, normalize, transform, and integrate security event data from multiple enterprise sources.
- Integrate logs from operating systems, network devices, applications, security tools, and infrastructure platforms to improve enterprise security visibility.
- Monitor and troubleshoot log ingestion failures, parsing errors, data quality issues, and system performance concerns.
- Collaborate with system owners and cybersecurity teams to ensure logging and auditing practices align with NIST SP 800-53 Audit and Accountability (AU) controls across multiple classified enclaves.
- Identify gaps in logging coverage and implement enhancements to improve threat detection, incident investigation, and security monitoring.
- Develop and optimize security event searches, correlation rules, dashboards, and reporting capabilities to support threat hunting and incident response.
- Coordinate with software and technology vendors to resolve SIEM platform issues and improve logging capabilities.
Required Qualifications:
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Engineering, or a related technical discipline, or an equivalent combination of education and relevant experience.
- Significant professional experience in cybersecurity engineering, vulnerability management, security monitoring, or enterprise security operations.
- Demonstrated hands-on experience administering and troubleshooting Tenable Security Center (Tenable.sc) or comparable enterprise vulnerability management platforms.
- Strong understanding of vulnerability scanning methodologies, credentialed scanning, vulnerability validation, risk assessment, and remediation processes.
- Hands-on experience administering, configuring, or supporting enterprise SIEM and centralized logging solutions.
- Experience with log collection, ingestion pipelines, event processing, indexing, parsing, and security event analysis.
- Knowledge of ETL processes, data integration, and security log normalization.
- Experience supporting security monitoring, incident response, threat analysis, or security investigations.
- Familiarity with NIST SP 800-53, particularly Audit and Accountability (AU) controls, and federal cybersecurity compliance requirements.
- Experience troubleshooting complex technical issues across enterprise operating systems, networks, applications, and security technologies.
- Ability to develop or maintain scripts and automated workflows using Python, PowerShell, Bash, or similar scripting languages.
- Strong analytical, problem-solving, technical documentation, and communication skills.
- Ability to work effectively with multidisciplinary technical teams and communicate cybersecurity risks to stakeholders.
Preferred Qualifications:
- US Citizen with an active Department of Defense (DoD) TS, Department of Energy (DOE) Q security clearance or equivalent.
- Bachelors degree in computer science, information assurance or related technical field with 7+ years of relevant experience.
- Experience supporting cybersecurity operations within Department of Defense (DoD), Department of Energy (DOE), or other federal government environments.
- Experience working within classified computing environments or multiple security enclaves.
- Advanced knowledge of Tenable Security Center, Nessus scanners, scan policy development, and vulnerability reporting.
- Experience with enterprise SIEM platforms such as Splunk, Elastic Security, IBM QRadar, or similar technologies.
- Experience designing or maintaining custom log ingestion pipelines, data transformations, and automated security workflows.
- Familiarity with Linux and Windows system administration, enterprise networking, and infrastructure security.
- Experience with security automation, REST APIs, system integrations, and scripting.
- Knowledge of NIST Risk Management Framework (RMF), continuous monitoring, and federal information security requirements.
- Experience supporting threat hunting, detection engineering, security analytics, or incident response activities.
- Relevant industry certifications such as CompTIA Security+, CySA+, CASP+/SecurityX, CISSP, GIAC, or equivalent cybersecurity credentials.
PHYSICAL REQUIREMENTS & ENVIRONMENTAL CONDITIONS
- Inside office environment.
- Working on a computer for long periods of time.
- May involve long period of sitting at a desk.
OTHER DUTIES
This job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities and activities may change at any time with or without notice.
Xcel Engineering is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regards to race, color, religion, religious creed, gender, sexual orientation, gender identity, gender expression, transgender, pregnancy, marital status, national origin, ancestry, citizenship status, age, disability, protected Veteran Status, genetics or any other characteristics protected by applicable federal, state or local law.
If you are a qualified individual with a disability or disabled veteran, you have the right to request a reasonable accommodation if you are unable or limited in your ability to use or access Xcel Engineering's current openings as a result of your disability. You can request reasonable accommodations by calling 855.212.1810. Thank you for your interest in Xcel Engineering.
See All 27 SIEM Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find SIEM Engineer JobsSIEM Engineer Job Market
Who's Hiring
Top Industries Hiring
- Government & Public Sector
What Employers Look For
The qualifications that appear most often in SIEM engineer jobs.
- Three or more years of hands-on experience administering a SIEM platform such as Splunk, Microsoft Sentinel, or IBM QRadar
- Proven ability to write custom correlation rules, detection use cases, and query logic in SPL, KQL, or AQL
- Experience integrating log sources including endpoints, cloud services, firewalls, and identity providers into a SIEM environment
- Relevant certification such as Splunk Core Certified Power User, Microsoft SC-200, or CompTIA CySA+
- Familiarity with MITRE ATT&CK framework and its application to detection engineering and alert triage
- Bachelor's degree in computer science, information security, or a related field, or equivalent demonstrated experience
Tips for Your SIEM Engineer Job Search
Align your resume to the platform
Tailor your resume to name the specific SIEM platform in each job posting, whether Splunk, Microsoft Sentinel, or IBM QRadar. Hiring managers scan for exact tool names, and a generic 'SIEM experience' line will not clear automated screening.
Certify before competing for senior roles
Splunk Core Certified Power User, Microsoft SC-200, and CompTIA CySA+ directly map to the platforms most enterprise employers run. Listing these certifications moves your application past the initial filter before anyone reads your work history.
Apply early to roles that fit
Migrate Mate lists siem engineer openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Show detection logic you wrote yourself
Bring two or three examples of custom correlation rules, detection use cases, or tuning decisions you authored. Interviewers for SIEM roles consistently test whether candidates can build content, not just operate a pre-configured environment.
Target postings that name your log sources
Job descriptions that list specific log sources, such as Windows Event Logs, AWS CloudTrail, or firewall feeds, signal an active deployment you can step into. Matching those log sources in your resume increases your interview callback rate on those openings.
Prepare for a live detection exercise
Many SIEM engineer interviews include a scenario where you're handed raw log data or a Splunk or Sentinel dashboard and asked to identify an anomaly or write a query on the spot. Practice SPL or KQL queries from recent detection challenges before your first technical screen.
SIEM Engineer Jobs: Frequently Asked Questions
Which companies are hiring the most siem engineers?
The most active employers for siem engineers right now are CrowdStrike, Booz Allen Hamilton, and SAIC, and the most openings are in Virginia, District of Columbia, and Texas, based on current listings on Migrate Mate as of November 2026. Financial services, defense contractors, and large healthcare systems consistently maintain the highest sustained demand for this role.
How many siem engineer jobs are remote?
About 92% of siem engineer openings are fully remote or hybrid as of November 2026, reflecting strong demand for distributed security operations coverage. Detection engineering, content development, and alert triage sub-specializations tend to be the most remote-friendly, while roles tied to on-premises infrastructure or classified government environments typically require on-site presence.
How do you become a siem engineer?
Start by building hands-on experience with at least one major SIEM platform through a home lab, cloud trial, or entry-level SOC analyst role where you work directly with log ingestion and alerting. Earn a platform-specific certification, practice writing detection logic against real log data, and build familiarity with the MITRE ATT&CK framework. Most engineers move into the role from a SOC analyst or security operations background rather than directly from school.
Can you get hired as a siem engineer with little experience?
Yes, some employers hire candidates with limited professional experience if you can demonstrate hands-on SIEM skills through a home lab, capture-the-flag competitions, or a portfolio of detection rules you built yourself. Targeting smaller security teams, managed security service providers, or companies mid-deployment on a new SIEM platform increases your chances, since those environments often need people willing to build content from scratch rather than maintain a mature setup.
What does the siem engineer interview process look like?
Most SIEM engineer interviews run three to four stages: an initial recruiter screen, a technical phone or video interview focused on your platform experience and detection approach, a hands-on exercise where you write queries or analyze log samples, and a final interview with the security team lead or hiring manager. Some employers add a take-home use-case build where you're asked to design a detection rule for a specific threat scenario before the final round.
Where can I find and apply to siem engineer jobs?
You can find and apply to siem engineer jobs on Migrate Mate, which lists current openings from across the United States. Find roles that match your platform experience and seniority level, then apply directly to each listing from the page.
See All 27 SIEM Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find SIEM Engineer Jobs