AppSec Engineer: Secure SDLC & SAP Tools (Hybrid)

Xcel Energy Services Inc; Denver (CO); Hybrid; USD 98,000 - 139,000; Full time

Benefits offered by this job

Annual Incentive Program

Medical Plan

Dental

Vision

Life Insurance

Health Savings Account

Job summary

Xcel Energy Services Inc. is seeking a Security Engineer – Application Security to embed security into the software delivery lifecycle, drive CI/CD security controls, and manage SAP‑related tooling (Onapsis).

You will triage findings, guide remediation, and collaborate with development teams to raise security maturity. The role requires strong hands‑on AppSec experience, tooling expertise, and coding ability in modern languages.

Qualifications

• Hands-on experience in Application Security, DevSecOps, or a closely related security engineering role.
• Experience operating AppSec tooling for static, dynamic, software composition, API, or related testing activities.
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows.
• Experience with findings intake, triage, remediation tracking, and exception handling for application security issues.
• Strong understanding of common web and application vulnerability classes and how they are identified and remediated.
• Practical experience with Onapsis or other SAP security tooling.
• Practical coding experience in one or more modern languages such as Python, Java, JavaScript/TypeScript, or C#.

Responsibilities

• Operate and tune AppSec tooling used for SAST, DAST, SCA, API security, secrets detection, and related testing activities.
• Integrate security checks, policies, and quality gates into CI/CD pipelines and developer workflows where technically feasible.
• Drive application security findings through intake, triage, remediation tracking, and exception workflows.
• Review code‑level findings and provide technically credible guidance on exploitability, risk context, and remediation options.
• Work with development and platform teams to implement secure SDLC practices and improve security outcomes in the delivery process.
• Serve as the primary internal SME for SAP‑related application security tooling (Onapsis) and processes.
• Support SAP secure development controls, including ABAP and UI5 code scanning, transport/change guardrails, and developer feedback workflows where applicable.
• Own and maintain all AppSec documentation, including standards support materials, program documents, procedures, workflows, runbooks, and team‑accessible documentation organization.
• Support tool transition and modernization efforts across comparable AppSec platforms without being tied to a single vendor.

Skills

Application Security

DevSecOps

CI/CD security

Onapsis SAP tooling

SAST/DAST/SCA

Coding: Python/Java/JS/C#

Independent SME

Tools

Onapsis

Job description

Xcel Energy Services Inc. is seeking a Security Engineer – Application Security to embed security into the software delivery lifecycle, drive CI/CD security controls, and manage SAP‑related tooling (Onapsis).

You will triage findings, guide remediation, and collaborate with development teams to raise security maturity. The role requires strong hands‑on AppSec experience, tooling expertise, and coding ability in modern languages.