Security Engineer - Application Security

Join Xcel Energy as a technical SME focused on application security operations, DevSecOps integration, and secure delivery workflows.

Responsibilities

• Run and fine-tune AppSec tooling for SAST, DAST, SCA, API security, secrets detection, and related testing activities
• Embed security checks, policies, and quality gates into CI/CD pipelines and developer workflows where technically feasible
• Manage application security findings end to end: intake, triage, remediation tracking, and exception handling
• Review code-level findings and provide technically credible guidance on exploitability, risk context, and remediation options
• Partner with development and platform teams to implement secure SDLC practices and improve delivery security outcomes
• Act as the primary internal SME for SAP-related application security tooling and processes, including Onapsis
• Support SAP secure development controls such as ABAP and UI5 code scanning, plus transport/change guardrails and developer feedback workflows (where applicable)
• Own and maintain AppSec documentation, including standards support materials, program documents, procedures, workflows, runbooks, and accessible team documentation organization
• Support tool transition and modernization across comparable AppSec platforms without being tied to a single vendor

Primary Objectives

• Shift security left into development and CI/CD workflows to catch issues earlier and reduce production defects
• Operate and improve AppSec tooling covering static, dynamic, software composition, API, and SAP-focused security testing
• Own intake, triage, tracking, and exception handling for application security findings
• Drive secure delivery practices, pipeline controls, and developer-facing security feedback that reduce risk before production

Requirements

• Hands-on experience in Application Security, DevSecOps, or a closely related security engineering role
• Experience operating AppSec tooling for static, dynamic, software composition, API, or related testing activities
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows
• Experience with findings intake, triage, remediation tracking, and exception handling for application security issues
• Strong understanding of common web and application vulnerability classes and how they are identified and remediated
• Practical experience with Onapsis or other SAP security tooling
• Practical coding experience in one or more modern languages: Python, Java, JavaScript/TypeScript, or C#
• Ability to operate independently as the primary technical SME for the AppSec program, tooling, and workflows

Preferred Qualifications

• Experience enabling secure SDLC practices, developer-facing security feedback, or secure coding guidance
• Familiarity with ABAP and UI5 code security in SAP environments
• Experience working with developer-native workflow platforms or pipeline tooling where security findings are surfaced and acted on

Certifications

• CSSLP, OSWE, GWAPT, or equivalent application security certification preferred

Technologies

• Onapsis, SAST, DAST, SCA, API security, secrets detection, CI/CD pipelines
• ABAP, UI5, SAP
• Python, Java, JavaScript/TypeScript, C#

Location and Work Model

• Denver, CO (hybrid)
• Three days per week in the office
• Must be located within Xcel Energy territory and reasonably close to an Xcel Energy facility
• Denver, Colorado and Minnesota areas preferred

Compensation

• Salary: USD 97,600 - 138,600 per year
• Anticipated starting base pay: $97,600.00 to $138,600.00 per year
• Annual Incentive Program

Benefits

• Medical/Pharmacy Plan
• Dental
• Vision
• Life Insurance
• Dependent Care Flexible Spending Account
• Health Care Flexible Spending Account
• Health Savings Account (HSA) (if enrolled in eligible health plan)
• Limited-Purpose FSA (if enrolled in eligible health plan and HSA)
• Transportation Reimbursement Account
• Short-term disability (STD)
• Long-term disability (LTD)
• Employee Assistance Program (EAP)
• Fitness Center Reimbursement (if enrolled in eligible health plan)
• Tuition reimbursement
• Transit programs
• Employee recognition program
• Pension
• 401(k) plan
• Paid time off (PTO)
• Holidays
• Volunteer Paid Time Off (VPTO)
• Parental Leave

Application

• Deadline to apply: 10/31/26

Cybersecurity Statement

All Xcel Energy employees and contractors share responsibility for protecting the company’s information and systems by adhering to cybersecurity policies, standards, and best practices, recognizing that cybersecurity is everyone’s responsibility.