Security Engineer - Application Security

Cybersecurity Jobs; Denver (CO); Hybrid; USD 98,000 - 139,000; Full time

Benefits offered by this job

Medical & Pharmacy

Dental

Vision

401(k) plan

Pension

PTO & Holidays

Transit benefits

Job summary

Xcel Energy is seeking a technical SME to strengthen application security operations, DevSecOps integration, and secure delivery workflows. You will run and tune AppSec tooling across SAST, DAST, SCA, API security, and secrets detection, embedding checks into CI/CD pipelines and developer workflows.

You will own intake, triage, remediation tracking, and exception handling for findings, and provide guidance on exploitability, risk, and remediation options.

Qualifications

• Hands-on experience in Application Security, DevSecOps, or security engineering.
• Experience operating AppSec tooling for static, dynamic, software composition, API, or related testing activities.
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows.
• Experience with findings intake, triage, remediation tracking, and exception handling for app security issues.
• Strong understanding of common web and application vulnerability classes and remediation approaches.
• Practical experience with Onapsis or other SAP security tooling.
• Coding experience in Python, Java, JavaScript/TypeScript, or C#.

Responsibilities

• Run and fine-tune AppSec tooling for SAST, DAST, SCA, API security, and secrets detection.
• Embed security checks into CI/CD pipelines and developer workflows.
• Manage application security findings end to end: intake, triage, remediation tracking, and exception handling.
• Review code-level findings and provide guidance on exploitability, risk, and remediation options.
• Partner with development and platform teams to implement secure SDLC practices and improve delivery security outcomes.
• Act as internal SME for SAP-related AppSec tooling and Onapsis processes.
• Support SAP secure development controls (ABAP and UI5 code scanning) and transport/change guardrails.
• Own and maintain AppSec documentation, standards, program docs, procedures, and runbooks.
• Support tool transition and modernization across AppSec platforms.

Skills

Application Security

DevSecOps

CI/CD pipelines

SAP Security

Onapsis

Python

Java

JavaScript/TypeScript

C#

Tools

Onapsis tooling

SAST tooling

DAST tooling

SCA tooling

API security tooling

ABAP security scanning

UI5 security scanning

Job description

Join Xcel Energy as a technical SME focused on application security operations, DevSecOps integration, and secure delivery workflows.

Responsibilities

• Run and fine-tune AppSec tooling for SAST, DAST, SCA, API security, secrets detection, and related testing activities
• Embed security checks, policies, and quality gates into CI/CD pipelines and developer workflows where technically feasible
• Manage application security findings end to end: intake, triage, remediation tracking, and exception handling
• Review code-level findings and provide technically credible guidance on exploitability, risk context, and remediation options
• Partner with development and platform teams to implement secure SDLC practices and improve delivery security outcomes
• Act as the primary internal SME for SAP-related application security tooling and processes, including Onapsis
• Support SAP secure development controls such as ABAP and UI5 code scanning, plus transport/change guardrails and developer feedback workflows (where applicable)
• Own and maintain AppSec documentation, including standards support materials, program documents, procedures, workflows, runbooks, and accessible team documentation organization
• Support tool transition and modernization across comparable AppSec platforms without being tied to a single vendor

Primary Objectives

• Shift security left into development and CI/CD workflows to catch issues earlier and reduce production defects
• Operate and improve AppSec tooling covering static, dynamic, software composition, API, and SAP-focused security testing
• Own intake, triage, tracking, and exception handling for application security findings
• Drive secure delivery practices, pipeline controls, and developer-facing security feedback that reduce risk before production

Requirements

• Hands-on experience in Application Security, DevSecOps, or a closely related security engineering role
• Experience operating AppSec tooling for static, dynamic, software composition, API, or related testing activities
• Experience integrating security checks, controls, or gates into CI/CD pipelines and developer workflows
• Experience with findings intake, triage, remediation tracking, and exception handling for application security issues
• Strong understanding of common web and application vulnerability classes and how they are identified and remediated
• Practical experience with Onapsis or other SAP security tooling
• Practical coding experience in one or more modern languages: Python, Java, JavaScript/TypeScript, or C#
• Ability to operate independently as the primary technical SME for the AppSec program, tooling, and workflows

Preferred Qualifications

• Experience enabling secure SDLC practices, developer-facing security feedback, or secure coding guidance
• Familiarity with ABAP and UI5 code security in SAP environments
• Experience working with developer-native workflow platforms or pipeline tooling where security findings are surfaced and acted on

Certifications

• CSSLP, OSWE, GWAPT, or equivalent application security certification preferred

Technologies

• Onapsis, SAST, DAST, SCA, API security, secrets detection, CI/CD pipelines
• ABAP, UI5, SAP
• Python, Java, JavaScript/TypeScript, C#

Location and Work Model

• Denver, CO (hybrid)
• Three days per week in the office
• Must be located within Xcel Energy territory and reasonably close to an Xcel Energy facility
• Denver, Colorado and Minnesota areas preferred

Compensation

• Salary: USD 97,600 - 138,600 per year
• Anticipated starting base pay: $97,600.00 to $138,600.00 per year
• Annual Incentive Program

Benefits

• Medical/Pharmacy Plan
• Dental
• Vision
• Life Insurance
• Dependent Care Flexible Spending Account
• Health Care Flexible Spending Account
• Health Savings Account (HSA) (if enrolled in eligible health plan)
• Limited-Purpose FSA (if enrolled in eligible health plan and HSA)
• Transportation Reimbursement Account
• Short-term disability (STD)
• Long-term disability (LTD)
• Employee Assistance Program (EAP)
• Fitness Center Reimbursement (if enrolled in eligible health plan)
• Tuition reimbursement
• Transit programs
• Employee recognition program
• Pension
• 401(k) plan
• Paid time off (PTO)
• Holidays
• Volunteer Paid Time Off (VPTO)
• Parental Leave

Application

• Deadline to apply: 10/31/26

Cybersecurity Statement

All Xcel Energy employees and contractors share responsibility for protecting the company’s information and systems by adhering to cybersecurity policies, standards, and best practices, recognizing that cybersecurity is everyone’s responsibility.