AppSec Engineer - SAP & CI/CD Security (Hybrid)

Xcel Energy; Denver (CO); Ibrido; USD 98.000 - 139.000; Tempo pieno

Vantaggi offerti da questo lavoro

Annual Incentive Program

Health insurance

Dental

Vision

Life Insurance

Tuition reimbursement

Pension

401(k) plan

PTO

Holidays

Parental Leave

Descrizione del lavoro

Xcel Energy is seeking a Security Engineer – Application Security in a hybrid Denver area role. You will embed security into the software delivery lifecycle, integrate checks into CI/CD pipelines, and drive remediation workflows across the AppSec program.

You will act as the SAP Onapsis SME, support ABAP/UI5 security controls, and maintain comprehensive AppSec documentation while collaborating with development teams to reduce risk before production.

Competenze

• Hands-on experience in Application Security, DevSecOps, or a security engineering role.
• Experience operating AppSec tooling for static, dynamic, software composition, API, or related testing activities.
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows.
• Experience with findings intake, triage, remediation tracking, and exception handling for application security issues.
• Strong understanding of common web and application vulnerability classes and how they are identified and remediated.
• Practical experience with Onapsis or other SAP security tooling.
• Practical coding experience in one or more modern languages such as Python, Java, JavaScript/TypeScript, or C#.
• Ability to operate independently as the primary technical SME for the AppSec program, tooling, and workflows.

Mansioni

• Operate and tune AppSec tooling used for SAST, DAST, SCA, API security, secrets detection, and related testing activities.
• Integrate security checks, policies, and quality gates into CI/CD pipelines and developer workflows where technically feasible.
• Drive application security findings through intake, triage, remediation tracking, and exception workflows.
• Review code-level findings and provide technically credible guidance on exploitability, risk context, and remediation options.
• Work with development and platform teams to implement secure SDLC practices and improve security outcomes in the delivery process.
• Serve as the primary internal SME for SAP-related application security tooling (Onapsis) and processes.
• Support SAP secure development controls, including ABAP and UI5 code scanning, transport/change guardrails, and developer feedback workflows where applicable.
• Own and maintain all AppSec documentation, including standards support materials, program documents, procedures, workflows, runbooks, and team-accessible documentation organization.
• Support tool transition and modernization efforts across comparable AppSec platforms without being tied to a single vendor.

Conoscenze

Application Security

DevSecOps

Security engineering

CI/CD pipelines

SAST

DAST

Onapsis

Python

Java

JavaScript/TypeScript

C#

Strumenti

Onapsis

CI/CD tooling

SAST tooling

DAST tooling

SCA tooling

Descrizione del lavoro

Xcel Energy is seeking a Security Engineer – Application Security in a hybrid Denver area role. You will embed security into the software delivery lifecycle, integrate checks into CI/CD pipelines, and drive remediation workflows across the AppSec program.

You will act as the SAP Onapsis SME, support ABAP/UI5 security controls, and maintain comprehensive AppSec documentation while collaborating with development teams to reduce risk before production.