Senior Technology Policy and Compliance Consultant

Xcel Energy•Denver, CO

3d•Onsite

About The Position

This position is responsible for providing project management (e.g., standard implementation plan), direction and leadership to the Technology and Security Services as it relates to Security and Regulatory Compliance and Service Policy. This will include providing policy and compliance guidance on new standards and technologies supporting agencies such as Department of Energy (e.g., Federal Energy Regulatory Commission (FERC), North American Electric Reliability Corporation (NERC)), Department of Homeland Security (e.g., Critical Gas Pipeline), Security and Exchange Commission (e.g., Sarbanes-Oxley), and Department of Commerce (e.g., National Institute of Standards and Technology (NIST)). This role drives the development of enterprise security policies and standards, oversees governance operations, and ensures alignment with security and regulatory requirements and industry frameworks. Operating as a strategic advisor and subject matter expert, the consultant provides thought leadership across the business, influences decision making, and strengthens the organization’s control environment. Direction of policy and standards program and coordination of the overall audit process for the regulators for Technology and Security Services. This effort will entail some project direction to establish and implement the updated standards, requirements and Company based policies process across the organization. Key liaison with the Compliance Governance process for the Technology and Security Services business area as it relates to overall company compliance standard implementation (e.g. Sarbanes Oxley). Communicate organizational vision, mission, key objectives and individual roles to others. Develop, model and inspire a strong commitment to employee safety, recognition, development and diversity in the workforce. Achieve employee satisfaction by providing a stimulating and rewarding work environment.

Requirements

Bachelor's degree or equivalent experience and at least 8 years of experience in security and IT or OT related fields.
Five years of experience in a GRC discipline.
Five years of work in a Governance, Risk, Compliance (GRC) function in a highly regulated environment (e.g. Utilities) may substitute for up to 18 months experience.
Proven success implementing security policies, standards, and/or controls.
Ability to define strategy and translate it into actionable plans impact organizational change.
Ability to work across the organization, building relationships and influencing peers and management through establishing trust and credibility.
Applies sound judgment and creativity to solve complex problems.
Ability to excel in a rapidly changing environment.
Strong verbal and written communication skills; ability to drive discussions and influence decision making; strong presentation and reporting skills.
Ability to communicate with and create documentation for technical and non-technical audiences.

Nice To Haves

Experience in one or more of the following areas: enterprise architecture, access controls, network administration, systems administration, SDLC / secure soft, encryption, asset management, identity and access management, IT or OT operations, security risk management.
Certification in one or more of the following: CISSP, CISM, CISA, CRISC, Security+, CPP or PSP.
Experience using a GRC tool (i.e. Archer).
Knowledge of regulatory requirements and frameworks such as NERC CIP, DHS TSA, SOX, ISO, NIST, COBIT, or Cyber Security Framework (CSF).

Responsibilities

Collaborate with cross functional teams to develop and implement new security policies and security standards, ensuring they incorporate applicable regulatory requirements and NIST based frameworks.
Interpret regulatory obligations and industry standards to determine their impact on the organization, translating complex requirements into clear, actionable policy and standard language.
Partner with subject matter experts to address new requirements, emerging risks, and evolving business needs, ensuring governance artifacts remain relevant, comprehensive, and aligned with best practices.
Evaluate the potential impact of new policies and standards across business areas and support stakeholders in understanding and adopting updated governance expectations.
Lead the execution of the security governance program, including the full lifecycle management of security policies and security standards.
Coordinate periodic reviews, updates, and approvals, as well as maintaining supporting processes such as mapping standards to applicable frameworks and regulations and ensuring required measures are captured and maintained.
Ensure enterprise security standards are accurately maintained within the eGRC platform to support downstream processes such as Issue Management, Exceptions, and Security Assurance (control testing).
Contribute to organizational continuous improvement efforts, promoting consistency, quality, and operational excellence across security governance and assurance functions.
Stay current on the evolving security landscape, including emerging threats, updates to security frameworks (e.g., NIST CSF and other relevant NIST publications), and changes to applicable regulations (e.g., NERC CIP, DHS TSA, SOX).
Compile, review, and analyze security information to formulate recommendations, metrics, and reports for management review and decision making.
Oversee the development, implementation, and maintenance of training, training materials, and events related to the ESS Governance Program.
Mentor and develop staff in technical and functional subject areas.