Security Engineer - Application Security

Security Engineer – Application Security Xcel Energy (NASDAQ: XEL) is a leading energy provider and Fortune 500 company, dedicated to serving millions of electricity and natural gas customers across eight states: Minnesota, Colorado, Wisconsin, Michigan, North Dakota, South Dakota, New Mexico and Texas. We make energy work better for our customers, helping them thrive every day. That means always raising the bar - delivering better service and providing more reliable, resilient, and sustainable energy. Xcel Energy is a place where you'll have opportunities to grow, expand your skills, and help lead the clean energy transition. We offer meaningful rewards, recognition, and support to help you build your career and make an impact - both on the job and beyond. Most importantly, it means you'll be joining a company that knows employees are the driving force behind its success and is committed to helping you be your best. Xcel Energy supports a hybrid work model to enable collaboration and flexibility. Many roles are expected to work onsite three days per week (Tuesday–Thursday); however, work location expectations vary based on role, team, and business needs. Role Summary The Security Engineer – Application Security is the technical SME responsible for running the AppSec program day to day with limited oversight. This role embeds security into the software delivery lifecycle, integrates security checks into CI/CD pipelines, drives intake and triage of application security findings, and tracks remediation and exceptions through closure. The role also serves as the primary internal SME for SAP-related application security tooling (Onapsis) and processes. This position reports to the Manager, Vulnerability Management. Primary Objectives

• Shift security left into development and CI/CD workflows so issues are caught earlier and fewer defects reach production.
• Operate and improve AppSec tooling used for static, dynamic, software composition, API, and SAP-specific security testing.
• Own intake, triage, tracking, and exception handling for application security findings.
• Drive secure delivery practices, pipeline controls, and developer-facing security feedback that reduce risk before production.

Responsibilities

• Operate and tune AppSec tooling used for SAST, DAST, SCA, API security, secrets detection, and related testing activities.
• Integrate security checks, policies, and quality gates into CI/CD pipelines and developer workflows where technically feasible.
• Drive application security findings through intake, triage, remediation tracking, and exception workflows.
• Review code-level findings and provide technically credible guidance on exploitability, risk context, and remediation options.
• Work with development and platform teams to implement secure SDLC practices and improve security outcomes in the delivery process.
• Serve as the primary internal SME for SAP-related application security tooling (Onapsis) and processes.
• Support SAP secure development controls, including ABAP and UI5 code scanning, transport/change guardrails, and developer feedback workflows where applicable.
• Own and maintain all AppSec documentation, including standards support materials, program documents, procedures, workflows, runbooks, and team-accessible documentation organization.
• Support tool transition and modernization efforts across comparable AppSec platforms without being tied to a single vendor.

Required Qualifications

• Hands-on experience in Application Security, DevSecOps, or a closely related security engineering role.
• Experience operating AppSec tooling for static, dynamic, software composition, API, or related testing activities.
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows.
• Experience with findings intake, triage, remediation tracking, and exception handling for application security issues.
• Strong understanding of common web and application vulnerability classes and how they are identified and remediated.
• Practical experience with Onapsis or other SAP security tooling.
• Practical coding experience in one or more modern languages such as Python, Java, JavaScript/TypeScript, or C#.
• Ability to operate independently as the primary technical SME for the AppSec program, tooling, and workflows.

Preferred Qualifications

• Experience enabling secure SDLC practices, developer-facing security feedback, or secure coding guidance.
• Familiarity with ABAP and UI5 code security in SAP environments.
• Experience working with developer-native workflow platforms or pipeline tooling where security findings are surfaced and acted on.

Certifications · CSSLP, OSWE, GWAPT, or equivalent application security certification preferred. Work Location Hybrid role requiring three days per week in the office. Must be located within Xcel Energy territory and reasonably close to an Xcel Energy facility. Denver, Colorado and Minnesota areas preferred. Our culture is grounded in shared values and employee commitments that guide how we work, support one another, and grow together. Our Values Connected, Committed, Trustworthy, Safe Our Employee Commitments Work that makes a difference A team you can count on Opportunities to grow Rewards that help you thrive Xcel Energy provides job applicants reasonable accommodations for disabilities throughout the application process. If you are in need of an accommodation to complete the application process, now or at any time in the future, please complete the Applicant Accommodation Request Form. Non-BargainingThe anticipated starting base pay for this position is: $97,600.00 to $138,600.00 per yearThis position is eligible for the following benefits: Annual Incentive Program, Medical/Pharmacy Plan, Dental, Vision, Life Insurance, Dependent Care Flexible Spending Account, Health Care Flexible Spending Account, Health Savings Account (HSA) (if enrolled in eligible health plan), Limited-Purpose FSA (if enrolled in eligible health plan and HSA), Transportation Reimbursement Account, Short-term disability (STD), Long-term disability (LTD), Employee Assistance Program (EAP), Fitness Center Reimbursement (if enrolled in eligible health plan), Tuition reimbursement, Transit programs, Employee recognition program, Pension, 401(k) plan, Paid time off (PTO), Holidays, Volunteer Paid Time Off (VPTO), Parental Leave Benefit plans are subject to change and Xcel Energy has the right to end, suspend, or amend any of its plans, at any time, in whole or in part. In any materials you submit, you may redact or remove age-identifying information including but not limited to dates of school attendance and graduation. You will not be penalized for redacting or removing this information. Deadline to Apply: 10/31/26 EEO is the Law (PDF)| Equal Opportunity Statement (PDF) |Employee Rights (PDF) All Xcel Energy employees and contractors share responsibility for protecting the company's information and systems by adhering to cybersecurity policies, standards, and best practices, recognizing that cybersecurity is everyone's responsibility. Accessibility Statement Xcel Energy