Security Engineer - Multi-Cloud Security

Xcel Energy; Denver (CO); Hybrid; USD 98,000 - 139,000; Full time

Benefits offered by this job

Annual Incentive Program

Medical/Pharmacy Plan

Dental

Vision

Life Insurance

401(k) plan

Paid time off (PTO)

Holidays

Job summary

Xcel Energy is seeking a Security Engineer - Multi-Cloud Security to build and run a cloud security program focused on reducing risk via visibility, guardrails, and automation. You’ll identify cloud security risks, drive remediation with stakeholders, and implement preventative controls. AWS is preferred; Azure familiarity is a plus.

Role reports to the Manager, Vulnerability Management. This hybrid position requires three days in the Denver office and proximity to Xcel Energy facilities in

Qualifications

• Minimum 5 years of experience in cloud security.
• Expert-level hands-on experience in either AWS or GCP; AWS preferred.
• Azure familiarity is nice to have but not required.
• Strong understanding of IAM, networking, logging, monitoring, and workload security.
• Experience using native cloud security tools or equivalents in AWS or GCP.
• Strong DevSecOps principles, CI/CD pipelines, and application security fundamentals.
• Basic understanding of SAP environments in cloud-hosted architectures.
• Experience identifying and communicating risk related to cloud configurations and architecture.
• Strong analytical and complex technical problem-solving skills.
• Ability to communicate technical risk clearly to non-technical stakeholders.
• Experience with APIs, scripting, or automation for data integration and workflow execution.
• Ability to operate independently and build a program with limited oversight.

Responsibilities

• Serve as a primary cloud security engineer with deep AWS or GCP expertise; AWS preferred.
• Leverage cloud security tools to identify and analyze risk.
• Maintain visibility across IAM, networking, logging, monitoring, and workload security posture.
• Develop guardrails, policies, and controls to prevent insecure configurations.
• Promote hardened images, containers, and standardized builds.
• Integrate findings into workflows and coordinate remediation with teams.
• Support remediation by driving findings to owners and tracking outcomes.
• Collaborate with Cloud Platform, SAP, Enterprise Architecture teams for improvements.
• Support DevSecOps practices, including CI/CD gates and automation.
• Assist SAP cloud security needs and awareness of SAP risks in cloud environments.
• Use APIs and scripting to automate data collection, analysis, and workflow execution.
• Communicate risk effectively to stakeholders.

Skills

Cloud security

AWS / GCP expertise

DevSecOps & CI/CD

Stakeholder communication

Independent program building

Tools

AWS Inspector

AWS Security Hub

Microsoft Defender for Cloud

Google Cloud Security Command Center

APIs / scripting automation

Job description

Xcel Energy (NASDAQ: XEL) is a leading energy provider and Fortune 500 company, dedicated to serving millions of electricity and natural gas customers across eight states: Minnesota, Colorado, Wisconsin, Michigan, North Dakota, South Dakota, New Mexico and Texas. We make energy work better for our customers, helping them thrive every day. That means always raising the bar - delivering better service and providing more reliable, resilient, and sustainable energy.

Xcel Energy is a place where you’ll have opportunities to grow, expand your skills, and help lead the clean energy transition. We offer meaningful rewards, recognition, and support to help you build your career and make an impact - both on the job and beyond. Most importantly, it means you’ll be joining a company that knows employees are the driving force behind its success and is committed to helping you be your best.

Xcel Energy supports a hybrid work model to enable collaboration and flexibility. Many roles are expected to work onsite three days per week (Tuesday–Thursday); however, work location expectations vary based on role, team, and business needs.

Role Summary

The Security Engineer - Multi-Cloud Security is responsible for building and running the cloud security program with a focus on reducing risk through visibility, guardrails, and automation. The role identifies and analyzes cloud security risk, drives remediation through stakeholders, and implements preventative controls to reduce exposure over time. The role operates in an advisory capacity and does not perform direct operational changes. The role requires deep expertise in AWS or GCP, with AWS preferred. Azure familiarity is valuable but not required. This position reports to the Manager, Vulnerability Management.

Primary Objectives

• Build and mature the multi-cloud security program with clear ownership, processes, and workflows.
• Identify, prioritize, and communicate cloud security risk across environments and stakeholders.
• Implement preventative controls and guardrails to reduce risk before deployment.
• Leverage automation and integration to reduce manual effort and improve consistency.
• Support remediation by driving findings to the appropriate owners and tracking outcomes.

Responsibilitie s

• Serve as a primary cloud security engineer with deep expertise in either AWS or GCP. AWS expertise is preferred. Azure familiarity is a plus.
• Use cloud-native security capabilities such as AWS Inspector, AWS Security Hub, Microsoft Defender for Cloud, Google Security Command Center, and related services to identify and analyze risk.
• Maintain visibility across identity and access management, network configuration, logging, monitoring, and workload security posture.
• Identify issues such as overly permissive access, unused accounts, misconfigurations, and exposure risks.
• Develop and implement guardrails, policies, and controls to prevent insecure configurations and reduce attack surface.
• Promote the use of hardened images, containers, and standardized builds to reduce risk at deployment.
• Integrate cloud security findings into existing workflows and coordinate remediation with responsible teams.
• Experience supporting ownership-accountability-first remediation models.
• Work closely with Cloud Platform, SAP, Enterprise Architecture, and other teams to implement meaningful security improvements.
• Partner with Application Security teams to support DevSecOps practices, including CI/CD pipeline integration, gates, and automation.
• Support SAP cloud security needs and maintain awareness of SAP-specific risks within cloud-hosted environments.
• Use APIs, scripting, and integration to automate data collection, analysis, and workflow execution.
• Analyze cloud risk in context and communicate clear, actionable recommendations to stakeholders.
• Support logging and monitoring capability setup and integration while deferring operational ownership to SOC/IR teams.

Required Qualifications

• Minimum 5 years of experience in cloud security.
• Expert-level hands‑on experience in either AWS or GCP. AWS expertise is preferred.
• Ability to transfer cloud security concepts across providers. Azure familiarity is nice to have but is not required.
• Strong understanding of cloud identity and access management, networking, logging, monitoring, and workload security.
• Experience using native cloud security tools or equivalent capabilities in AWS or GCP.
• Strong understanding of DevSecOps principles, CI/CD pipelines, and application security fundamentals.
• Basic understanding of SAP environments in cloud-hosted architectures.
• Experience identifying and communicating risk related to cloud configurations and architecture.
• Strong analytical and complex technical problem‑solving skills.
• Ability to communicate technical risk clearly to non-technical stakeholders.
• Experience with APIs, scripting, or automation for data integration and workflow execution.
• Ability to operate independently and build a program with limited oversight.

Preferred Qualifications

• Deep AWS security experience, including multi-account and GovCloud architectures, or deep GCP security experience.
• Experience supporting security across more than one cloud platform; Azure experience is a plus.
• Experience implementing preventative security controls such as guardrails, policy enforcement, or pipeline gating.
• Experience improving data quality and visibility across multiple cloud and security data sources.
• Experience working with enterprise cloud platform, networking, or architecture teams.
• Experience with Qualys Cloud Security Posture Management (CSPM).
• Experience supporting attribution‑driven remediation governance frameworks.

Certifications

• A current, relevant security or architecture certification for the candidate’s primary cloud platform is required and will be validated.
• AWS Certified Security - Specialty is preferred for AWS-focused candidates.
• AWS Certified Solutions Architect - Professional or AWS Certified DevOps Engineer - Professional is a plus.
• Comparable advanced GCP security or architecture certifications are accepted for GCP-focused candidates. Azure certifications are considered supplemental.

Work Location

Hybrid role requiring three days per week in the office. Must be located within Xcel Energy territory and reasonably close to an Xcel Energy facility. Denver, Colorado and Minnesota areas preferred.

Our culture is grounded in shared values and employee commitments that guide how we work, support one another, and grow together.

Our Values

Connected, Committed, Trustworthy, Safe

Our Employee Commitments

• Work that makes a difference
• A team you can count of
• Opportunities to grow
• Rewards that help you thrive

Non-Bargaining

The anticipated starting base pay for this position is: $97,600.00 to $138,600.00 per year

This position is eligible for the following benefits: Annual Incentive Program, Medical/Pharmacy Plan, Dental, Vision, Life Insurance, Dependent Care Flexible Spending Account, Health Care Flexible Spending Account, Health Savings Account (HSA) (if enrolled in eligible health plan), Limited-Purpose FSA (if enrolled in eligible health plan and HSA), Transportation Reimbursement Account, Short-term disability (STD), Long-term disability (LTD), Employee Assistance Program (EAP), Fitness Center Reimbursement (if enrolled in eligible health plan), Tuition reimbursement, Transit programs, Employee recognition program, Pension, 401(k) plan, Paid time off (PTO), Holidays, Volunteer Paid Time Off (VPTO), Parental Leave

Benefit plans are subject to change and Xcel Energy has the right to end, suspend, or amend any of its plans, at any time, in whole or in part.

In any materials you submit, you may redact or remove age-identifying information including but not limited to dates of school attendance and graduation. You will not be penalized for redacting or removing this information.

Deadline to Apply: 11/30/26

EEO is the Law (PDF) | Equal Opportunity Statement (PDF) | Employee Rights (PDF)

All Xcel Energy employees and contractors share responsibility for protecting the company's information and systems by adhering to cybersecurity policies, standards, and best practices, recognizing that cybersecurity is everyone's responsibility.

Accessibility Statement

Xcel Energy endeavors to make https://www.xcelenergy.com and https://jobs.xcelenergy.com accessible to any and all users. If you are in need of an accommodation to complete the application process, now or at any time in the future, please complete the Applicant Accommodation Request Form (https://forms.cloud.microsoft/pages/responsepage.aspx?id=g6WyJAVcaku06U4S3AAlrVld9SFTyvlNkqxgjYWAK9xUQ1JIS1JUSjg3TkNXU1hVU01PS1pVSEVDNSQlQCN0PWcu&route=shorturl). For any other application related questions, including application follow-ups or technical issues, please use our Recruiting Assistance, Electra, for assistance. Electra can be found in the lower right-hand corner of our Xcel Energy Careers site.