Security Engineer - Multi-Cloud Security

Xcel Energy•Minneapolis, MN

3d•$97,600 - $138,600•Hybrid

About The Position

The Security Engineer - Multi-Cloud Security builds and runs Xcel Energy’s cloud security program, focusing on reducing risk through visibility, guardrails, and automation. The role identifies and analyzes cloud security risks, communicates actionable recommendations, drives remediation with responsible stakeholders, and implements preventative controls to reduce exposure over time. It works in an advisory capacity and does not perform direct operational changes. Deep expertise in AWS or GCP is required, with AWS preferred; Azure familiarity is valuable but not required. The engineer uses cloud-native security capabilities to assess identity and access management, network configuration, logging, monitoring, and workload security posture. The position develops preventative policies and controls, promotes hardened images and standardized builds, integrates security findings into existing workflows, and partners with Cloud Platform, SAP, Enterprise Architecture, Application Security, and other teams. It also supports DevSecOps practices, SAP cloud security needs, automation and data integration, and logging and monitoring setup while leaving operational ownership to SOC/IR teams. This is a hybrid role requiring three days per week in the office. The employee must be located within Xcel Energy territory and reasonably close to an Xcel Energy facility; Denver, Colorado, and Minnesota areas are preferred. The position reports to the Manager, Vulnerability Management.

Requirements

Minimum 5 years of experience in cloud security.
Expert-level hands-on experience in AWS or GCP; AWS expertise is preferred.
Ability to transfer cloud security concepts across providers.
Strong understanding of cloud identity and access management, networking, logging, monitoring, and workload security.
Experience using native cloud security tools or equivalent capabilities in AWS or GCP.
Strong understanding of DevSecOps principles, CI/CD pipelines, and application security fundamentals.
Basic understanding of SAP environments in cloud-hosted architectures.
Experience identifying and communicating risks related to cloud configurations and architecture.
Strong analytical and complex technical problem-solving skills.
Ability to communicate technical risk clearly to non-technical stakeholders.
Experience with APIs, scripting, or automation for data integration and workflow execution.
Ability to operate independently and build a program with limited oversight.
A current, relevant security or architecture certification for the candidate’s primary cloud platform is required and will be validated.

Nice To Haves

Deep AWS security experience, including multi-account and GovCloud architectures, or deep GCP security experience.
Experience supporting security across more than one cloud platform; Azure experience is a plus.
Experience implementing preventative security controls such as guardrails, policy enforcement, or pipeline gating.
Experience improving data quality and visibility across multiple cloud and security data sources.
Experience working with enterprise cloud platform, networking, or architecture teams.
Experience with Qualys Cloud Security Posture Management (CSPM).
Experience supporting attribution-driven remediation governance frameworks.
AWS Certified Security - Specialty for AWS-focused candidates.
AWS Certified Solutions Architect - Professional or AWS Certified DevOps Engineer - Professional.
Comparable advanced GCP security or architecture certifications for GCP-focused candidates.

Responsibilities

Build and mature the multi-cloud security program with clear ownership, processes, and workflows.
Identify, prioritize, analyze, and communicate cloud security risks across environments and stakeholders.
Use AWS Inspector, AWS Security Hub, Microsoft Defender for Cloud, Google Security Command Center, or related capabilities to identify and analyze risk.
Maintain visibility across identity and access management, network configuration, logging, monitoring, and workload security posture.
Identify overly permissive access, unused accounts, misconfigurations, and exposure risks.
Develop and implement guardrails, policies, and controls to prevent insecure configurations and reduce attack surface.
Promote hardened images, containers, and standardized builds to reduce risk at deployment.
Integrate cloud security findings into existing workflows, coordinate remediation with responsible teams, and track outcomes.
Support ownership-accountability-first remediation models.
Work with Cloud Platform, SAP, Enterprise Architecture, and other teams to implement security improvements.
Partner with Application Security teams on DevSecOps practices, including CI/CD pipeline integration, gates, and automation.
Support SAP cloud security needs and maintain awareness of SAP-specific risks in cloud-hosted environments.
Use APIs, scripting, and integration to automate data collection, analysis, and workflow execution.
Communicate clear, actionable recommendations to stakeholders based on cloud risk analysis.
Support logging and monitoring capability setup and integration while deferring operational ownership to SOC/IR teams.