Security Engineer - Application Security

Xcel Energy (NASDAQ:XEL) is a leading energy provider and Fortune 500 company, dedicated to serving millions of electricity and natural gas customers across eight states:
Minnesota, Colorado, Wisconsin, Michigan, North Dakota, South Dakota, New Mexico and Texas. We make energy work better for our customers, helping them thrive every day. That means always raising the bar - delivering better service and providing more reliable, resilient, and sustainable energy.

Xcel Energy is a place where you'll have opportunities to grow, expand your skills, and help lead the clean energy transition. We offer meaningful rewards, recognition, and support to help you build your career and make an impact - both on the job and beyond. Most importantly, it means you'll be joining a company that knows employees are the driving force behind its success and is committed to helping you be your best.

Xcel Energy supports a hybrid work model to enable collaboration and flexibility. Many roles are expected to work onsite three days per week (Tuesday-Thursday); however, work location expectations vary based on role, team, and business needs.

The Security Engineer - Application Security is the technical SME responsible for running the App Sec program day to day with limited oversight. This role embeds security into the software delivery lifecycle, integrates security checks into CI/CD pipelines, drives intake and triage of application security findings, and tracks remediation and exceptions through closure. The role also serves as the primary internal SME for SAP-related application security tooling (Onapsis) and processes.

This position reports to the Manager, Vulnerability Management.

• Shift security left into development and CI/CD workflows so issues are caught earlier and fewer defects reach production.
• Operate and improve App Sec tooling used for static, dynamic, software composition, API, and SAP-specific security testing.
• Own intake, triage, tracking, and exception handling for application security findings.
• Drive secure delivery practices, pipeline controls, and developer-facing security feedback that reduce risk before production.

• Operate and tune App Sec tooling used for SAST, DAST, SCA, API security, secrets detection, and related testing activities.
• Integrate security checks, policies, and quality gates into CI/CD pipelines and developer workflows where technically feasible.
• Drive application security findings through intake, triage, remediation tracking, and exception workflows.
• Review code-level findings and provide technically credible guidance on exploitability, risk context, and remediation options.
• Work with development and platform teams to implement secure SDLC practices and improve security outcomes in the delivery process.
• Serve as the primary internal SME for SAP-related application security tooling (Onapsis) and processes.
• Support SAP secure development controls, including ABAP and UI5 code scanning, transport/change guardrails, and developer feedback workflows where applicable.
• Own and maintain all App Sec documentation, including standards support materials, program documents, procedures, workflows, runbooks, and team-accessible documentation organization.
• Support tool transition and modernization efforts across comparable App Sec platforms without being tied to a single vendor.

• Hands-on experience in Application Security, Dev Sec Ops , or a closely related security engineering role.
• Experience operating App Sec tooling for static, dynamic, software composition, API, or related testing activities.
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows.
• Experience with findings intake,…