AppSec Engineer: DevSecOps & SAP Security (Hybrid Denver)

Cybersecurity Jobs; Denver (CO); Hybrid; USD 98,000 - 139,000; Full time

Benefits offered by this job

Medical & Pharmacy

Dental

Vision

401(k) plan

Pension

PTO & Holidays

Transit benefits

Job summary

Xcel Energy is seeking a technical SME to strengthen application security operations, DevSecOps integration, and secure delivery workflows. You will run and tune AppSec tooling across SAST, DAST, SCA, API security, and secrets detection, embedding checks into CI/CD pipelines and developer workflows.

You will own intake, triage, remediation tracking, and exception handling for findings, and provide guidance on exploitability, risk, and remediation options.

Qualifications

• Hands-on experience in Application Security, DevSecOps, or security engineering.
• Experience operating AppSec tooling for static, dynamic, software composition, API, or related testing activities.
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows.
• Experience with findings intake, triage, remediation tracking, and exception handling for app security issues.
• Strong understanding of common web and application vulnerability classes and remediation approaches.
• Practical experience with Onapsis or other SAP security tooling.
• Coding experience in Python, Java, JavaScript/TypeScript, or C#.

Responsibilities

• Run and fine-tune AppSec tooling for SAST, DAST, SCA, API security, and secrets detection.
• Embed security checks into CI/CD pipelines and developer workflows.
• Manage application security findings end to end: intake, triage, remediation tracking, and exception handling.
• Review code-level findings and provide guidance on exploitability, risk, and remediation options.
• Partner with development and platform teams to implement secure SDLC practices and improve delivery security outcomes.
• Act as internal SME for SAP-related AppSec tooling and Onapsis processes.
• Support SAP secure development controls (ABAP and UI5 code scanning) and transport/change guardrails.
• Own and maintain AppSec documentation, standards, program docs, procedures, and runbooks.
• Support tool transition and modernization across AppSec platforms.

Skills

Application Security

DevSecOps

CI/CD pipelines

SAP Security

Onapsis

Python

Java

JavaScript/TypeScript

C#

Tools

Onapsis tooling

SAST tooling

DAST tooling

SCA tooling

API security tooling

ABAP security scanning

UI5 security scanning

Job description

Xcel Energy is seeking a technical SME to strengthen application security operations, DevSecOps integration, and secure delivery workflows. You will run and tune AppSec tooling across SAST, DAST, SCA, API security, and secrets detection, embedding checks into CI/CD pipelines and developer workflows.

You will own intake, triage, remediation tracking, and exception handling for findings, and provide guidance on exploitability, risk, and remediation options.