Security Engineer - Application Security

Xcel Energy • Denver, CO

1d • Hybrid

About The Position

The Security Engineer – Application Security is the technical subject matter expert responsible for operating Xcel Energy’s Application Security program day to day with limited oversight. The role embeds security into the software delivery lifecycle, integrates security checks into CI/CD pipelines, manages application security findings through remediation or exception closure, and drives secure delivery practices that reduce risk before production. It is also the primary internal SME for SAP-related application security tooling and processes, including Onapsis. The position reports to the Manager, Vulnerability Management.

This is a hybrid role requiring three days per week in the office. The employee must be located within Xcel Energy territory and reasonably close to an Xcel Energy facility; Denver, Colorado, and Minnesota areas are preferred. Xcel Energy is a leading energy provider serving electricity and natural gas customers across eight states and supports a hybrid work model to enable collaboration and flexibility.

Requirements

• Hands-on experience in Application Security, DevSecOps, or a closely related security engineering role.
• Experience operating application security tools for static, dynamic, software composition, API, or related testing activities.
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows.
• Experience handling application security findings intake, triage, remediation tracking, and exceptions.
• Strong understanding of common web and application vulnerability classes and how they are identified and remediated.
• Practical experience with Onapsis or other SAP security tooling.
• Practical coding experience in one or more modern languages such as Python, Java, JavaScript/TypeScript, or C#.
• Ability to work independently as the primary technical SME for the AppSec program, tooling, and workflows.
• Must be located within Xcel Energy territory and reasonably close to an Xcel Energy facility.

Nice To Haves

• Experience enabling secure SDLC practices, developer-facing security feedback, or secure coding guidance.
• Familiarity with ABAP and UI5 code security in SAP environments.
• Experience with developer-native workflow platforms or pipeline tooling where security findings are surfaced and acted upon.
• CSSLP, OSWE, GWAPT, or an equivalent application security certification.

Responsibilities

• Operate and tune application security tools for SAST, DAST, software composition analysis, API security, secrets detection, and related testing.
• Integrate security checks, policies, and quality gates into CI/CD pipelines and developer workflows where technically feasible.
• Manage application security findings from intake and triage through remediation tracking and exception workflows.
• Review code-level findings and advise on exploitability, risk context, and remediation options.
• Work with development and platform teams to implement secure SDLC practices and improve security outcomes in delivery processes.
• Serve as the primary internal SME for SAP-related application security tooling, including Onapsis, and associated processes.
• Support SAP secure development controls, including ABAP and UI5 code scanning, transport and change guardrails, and developer feedback workflows where applicable.
• Own and maintain AppSec documentation, including standards support materials, program documents, procedures, workflows, runbooks, and team-accessible documentation organization.
• Support transitions and modernization across comparable AppSec platforms without dependence on a single vendor.

Benefits

• Annual incentive program
• Medical/pharmacy plan
• Dental insurance
• Vision insurance
• Life insurance
• Dependent care flexible spending account
• Health care flexible spending account
• Health savings account (if enrolled in an eligible health plan)
• Limited-purpose flexible spending account (if enrolled in an eligible health plan and HSA)
• Transportation reimbursement account
• Short-term disability
• Long-term disability
• Employee assistance program
• Fitness center reimbursement (if enrolled in an eligible health plan)
• Tuition reimbursement
• Transit programs
• Employee recognition program
• Pension
• 401(k) plan
• Paid time off
• Holidays
• Volunteer paid time off
• Parental leave

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed