Security Engineer - Application Security

Join Xcel Energy as a technical SME focused on application security operations, Dev Sec Ops  integration, and secure delivery workflows.

• Run and fine-tune App Sec tooling for SAST
  , DAST
  , SCA
  , API security
  , secrets detection
  , and related testing activities
• Embed security checks, policies, and quality gates into CI/CD pipelines and developer workflows where technically feasible
• Manage application security findings end to end:
  intake
  , triage
  , remediation tracking
  , and exception handling
• Review code-level findings and provide technically credible guidance on exploitability
  , risk context
  , and remediation options
• Partner with development and platform teams to implement secure SDLC practices and improve delivery security outcomes
• Act as the primary internal SME for SAP-related application security tooling and processes, including Onapsis
• Support SAP secure development controls such as ABAP and UI5 code scanning
  , plus transport/change guardrails and developer feedback workflows (where applicable)
• Own and maintain App Sec documentation, including standards support materials, program documents, procedures, workflows, runbooks, and accessible team documentation organization
• Support tool transition and modernization across comparable App Sec platforms without being tied to a single vendor

• Shift security left into development and CI/CD workflows to catch issues earlier and reduce production defects
• Operate and improve App Sec tooling covering static, dynamic, software composition, API, and SAP-focused security testing
• Own intake, triage, tracking, and exception handling for application security findings
• Drive secure delivery practices, pipeline controls, and developer-facing security feedback that reduce risk before production

• Hands-on experience in Application Security
  , Dev Sec Ops , or a closely related security engineering role
• Experience operating App Sec tooling for static
  , dynamic
  , software composition
  , API
  , or related testing activities
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows
• Experience with findings intake, triage, remediation tracking, and exception handling for application security issues
• Strong understanding of common web and application vulnerability classes and how they are identified and remediated
• Practical experience with Onapsis or other SAP security tooling
• Practical coding experience in one or more modern languages:
  Python
  , Java
  , JavaScript/Type Script , or C#
• Ability to operate independently as the primary technical SME for the App Sec program, tooling, and workflows

• Experience enabling secure SDLC practices, developer-facing security feedback, or secure coding guidance
• Familiarity with ABAP and UI5 code security in SAP environments
• Experience working with developer-native workflow platforms or pipeline tooling where security findings are surfaced and acted on

• CSSLP
  , OSWE
  , GWAPT
  , or equivalent application security certification preferred

• Onapsis
  , SAST
  , DAST
  , SCA
  , API security
  , secrets detection
  , CI/CD pipelines
• ABAP
  , UI5
  , SAP
• Python
  , Java
  , JavaScript/Type Script , C#

• Denver, CO (hybrid)
• Three days per week in the office
• Must be located within Xcel Energy territory and reasonably close to an Xcel Energy facility
• Denver, Colorado and Minnesota areas preferred

• Salary:
  USD 97, per year
• Anticipated starting base pay: $97,600.00 to $ per year
• Annual Incentive Program

• Medical/Pharmacy Plan
• Dental
• Vision
• Life Insurance
• Dependent Care Flexible Spending Account
• Health Care Flexible Spending Account
• Health Savings Account (HSA) (if enrolled in eligible health plan)
• Limited-Purpose FSA (if enrolled in eligible health plan and HSA)
• Transportation Reimbursement Account
• Short-term disability (STD)
• Long-term disability (LTD)
• Employee Assistance Program (EAP)
• Fitness Center Reimbursement (if enrolled in eligible health plan)
• Tuition reimbursement
• Transit programs
• Employee recognition program
• Pension
• 401(k) plan
• Paid time off (PTO)
• Holidays
• Volunteer Paid Time Off (VPTO)
• Parental Leave

• Final date to receive applications:
  10/31/26

All Xcel Energy employees and contractors share responsibility for protecting the company’s information and systems by adhering to cybersecurity policies, standards, and best practices, recognizing that cybersecurity is everyone’s responsibility.