Security Engineer - Application Security

This hybrid role in Denver supports the day-to-day operation of Application Security (AppSec) and embeds app security into CI/CD.

Responsibilities

• Operate and tune AppSec tooling for SAST, DAST, SCA, API security, secrets detection, and related testing activities
• Integrate security checks, policies, and quality gates into CI/CD pipelines and developer workflows where technically feasible
• Own application security findings lifecycle, including intake, triage, remediation tracking, and exception handling
• Review code-level findings and provide technically credible guidance on exploitability, risk context, and remediation options
• Partner with development and platform teams to implement secure SDLC practices and improve security outcomes in delivery
• Serve as the primary internal SME for SAP-related application security tooling, including Onapsis
• Support SAP secure development controls, including ABAP and UI5 code scanning, transport/change guardrails, and developer feedback workflows where applicable
• Own and maintain AppSec documentation: standards support materials, program documents, procedures, workflows, runbooks, and team-accessible documentation organization
• Support tool transition and modernization across comparable AppSec platforms without being tied to a single vendor

Requirements

• Hands-on experience in Application Security, DevSecOps, or a closely related security engineering role
• Experience operating AppSec tooling for static, dynamic, software composition, API, or related testing activities
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows
• Experience with findings intake, triage, remediation tracking, and exception handling for application security issues
• Strong understanding of common web and application vulnerability classes and how to identify and remediate them
• Practical experience with Onapsis or other SAP security tooling
• Practical coding experience in one or more modern languages: Python, Java, JavaScript/TypeScript, or C#
• Ability to operate independently as the primary technical SME for the AppSec program, tooling, and workflows

Primary Objectives

• Shift security left into development and CI/CD workflows to catch issues earlier and reduce production defects
• Operate and improve AppSec tooling for static, dynamic, software composition, API, and SAP-specific security testing
• Own intake, triage, tracking, and exception handling for application security findings
• Drive secure delivery practices, pipeline controls, and developer-facing security feedback to reduce risk before production

Technologies

• Onapsis, SAST, DAST, SCA, API security, secrets detection, CI/CD pipelines
• ABAP, UI5, Python, Java, JavaScript/TypeScript, C#, SAP

Preferred Qualifications

• Experience enabling secure SDLC practices, developer-facing security feedback, or secure coding guidance
• Familiarity with ABAP and UI5 code security in SAP environments
• Experience working with developer-native workflow platforms or pipeline tooling where security findings are surfaced and acted on

Certifications

• CSSLP, OSWE, GWAPT, or equivalent application security certification preferred

Benefits

• Annual Incentive Program
• Medical/Pharmacy Plan, Dental, Vision
• Life Insurance
• Dependent Care Flexible Spending Account
• Health Care Flexible Spending Account
• Health Savings Account (HSA) (if enrolled in eligible health plan)
• Limited-Purpose FSA (if enrolled in eligible health plan and HSA)
• Transportation Reimbursement Account
• Short-term disability (STD), Long-term disability (LTD)
• Employee Assistance Program (EAP)
• Fitness Center Reimbursement (if enrolled in eligible health plan)
• Tuition reimbursement
• Transit programs
• Employee recognition program
• Pension, 401(k) plan
• Paid time off (PTO), Holidays, Volunteer Paid Time Off (VPTO)
• Parental Leave

Work Location

• Hybrid role requiring three days per week in the office
• Must be located within Xcel Energy territory and reasonably close to an Xcel Energy facility
• Denver, Colorado and Minnesota areas preferred

Compensation

• Annual base pay range: $97,600 - $138,600
• Anticipated starting base pay: $97,600.00 to $138,600.00 per year

Application Deadline

10/31/26

Cybersecurity Statement

All Xcel Energy employees and contractors share responsibility for protecting the company’s information and systems by adhering to cybersecurity policies, standards, and best practices, recognizing that cybersecurity is everyone’s responsibility.