Senior Security and Compliance Analyst

Xcel Energy Services Inc; Minneapolis (MN); Hybrid; USD 85,000 - 121,000; Full time

Benefits offered by this job

Annual Incentive Program

Medical/Pharmacy Plan

Dental

Vision

Life Insurance

401(k) plan

PTO

Job summary

Xcel Energy is seeking a Senior Security Governance and Controls Analyst to help develop and execute the security governance program across policies, controls, training, and metrics. You will collaborate with security teams and business units to implement controls and ensure regulatory compliance, including NERC CIP and SOX, while driving continuous improvement.

Responsibilities include leading policy reviews, mapping standards to regulations, performing control testing, and delivering reports

Qualifications

• Bachelor's degree or equivalent experience with at least 4 years in security or IT/OT.
• At least 3 years in control testing, security standards/policy implementation, audits, or risk management.
• GRC experience in a regulated environment preferred; can substitute for up to 18 months.

Responsibilities

• Lead development and maintenance of policy and compliance governance programs.
• Oversee security policies and standards lifecycle; manage review schedules.
• Develop and evaluate security controls, self-assessments, and risk identification.
• Produce management reports and metrics; support training and awareness.

Skills

Governance

GRC

Security Audits

Control Testing

Policy Implementation

Regulatory Compliance

Risk Management

Documentation

Communication Skills

Education

Bachelor's degree or equivalent experience

Tools

Archer

Job description

Xcel Energy (NASDAQ: XEL) is a leading energy provider and Fortune 500 company, dedicated to serving millions of electricity and natural gas customers across eight states: Minnesota, Colorado, Wisconsin, Michigan, North Dakota, South Dakota, New Mexico and Texas. We make energy work better for our customers, helping them thrive every day. That means always raising the bar - delivering better service and providing more reliable, resilient, and sustainable energy. Xcel Energy is a place where you’ll have opportunities to grow, expand your skills, and help lead the clean energy transition. We offer meaningful rewards, recognition, and support to help you build your career and make an impact - both on the job and beyond. Most importantly, it means you’ll be joining a company that knows employees are the driving force behind its success and is committed to helping you be your best. Xcel Energy supports a hybrid work model to enable collaboration and flexibility. Many roles are expected to work onsite three days per week (Tuesday–Thursday); however, work location expectations vary based on role, team, and business needs.

Position Summary

As a Senior Security Governance and Controls Analyst, you will be responsible for contributing to the develop of and the execution of the security governance and control program focused on security policies and standards, security controls assurance program, training and awareness, and metrics and reporting. Security controls assurance involves the development and evaluation of security controls, self-assessments, and spot-checks. Partners across the security organization, as well as other business units, to facilitate the adoption of security controls. Contributes to the organizational continuous improvement program, driving consistency and quality across the organization. In addition, designated as a regulation security liaison. A liaison is the business area point of contact for managing, coordinating or facilitating regulatory compliance operations within the business area.

Essential Responsibilities

• PROGRAM DEVELOPMENT & MAINTENANCE: Lead the development and implementation of the department's policy and compliance governance program and supporting procedures documentation. Ensure security standard requirements are mapped to key regulations and frameworks. Establish relationships and partner with industry and business unit subject matter experts to identify and document new requirements and supporting controls. Maintain enterprise security standards in eGRC system to support downstream processes (i.e., Issue Management and Exceptions and Security Assurance (control testing)). Contribute to the development and implementation of the compliance assurance program and supporting procedure documentation. Lead the development and implementation of the CIP compliance management program and supporting procedure documentation.
• PROGRAM EXECUTION (OPERATIONS): Significant contributor to the execution of security governance program focused on security policies and security standards lifecycle. Lead in the review and update cycles for security policies and security standards with respective owner and subject matter experts. This includes developing a review schedule, assigning responsibilities within team and service teams. Lead in the development and evaluation of security controls, self-assessments, spot-checks, risk identification, process gaps, and process alignment. Contributes to the organizational continuous improvement program, driving consistency and quality across the organization. Stay current on relevant industry security threat landscape, changes in security frameworks (i.e., NIST CSF, other NIST as applicable), and in scope regulations (i.e., NERC CIP, DHS TSA, and SOX).
• PROGRAM METRICS & REPORTING: Compile and review output from security controls assessment program. Work with leads to analyze information and formulate recommendations and reports for management review and decision making. Contribute to the identification and management of security metrics and reporting for leadership and applicable business units.
• PROGRAM TRAINING AND AWARENESS: Lead the development and implementation of the training and awareness of ESEM Governance program. Develop and deliver training and awareness content to educate applicable business units about the ESEM governance program and security standards.
• Other duties as assigned.

Minimum Requirements

• Bachelor's degree or equivalent experience and at least 4 years of experience in security and IT or OT related fields.
• Three years of experience with control testing, security standards/policy implementation, security audits, or security risk management.
• One year of working in a Governance, Risk & Compliance (GRC) function in a highly regulated environment (e.g. Utilities) may substitute for up to 18 months experience.
• Self-starter; adaptable to change. Ability to set and achieve personal and program goals, and to track performance against those goals. Ability to work effectively across the organization, establishing positive working relationships, and building trust. Applies sound judgment and creativity to solve complex problems. Strong verbal and written communication skills. Demonstrated ability to create documentation for technical and non-technical audiences.

Preferred Requirements

• Experience in one or more of the following areas: physical access controls, network administration, systems administration, SDLC / secure soft, encryption, asset management, identity and access management, IT or OT operations, security risk management.
• Certification in one or more of the following: CISM, CISA, CRISC, CISSP, Security+, CPP or PSP.
• Experience using a GRC tool (i.e. Archer). Knowledge of regulatory requirements/frameworks such as PCI, NERC CIP, DHS TSA, SOX, HIPPA, ISO, NIST, COBIT, or Cyber Security Framework (CSF).

Our culture is grounded in shared values and employee commitments that guide how we work, support one another, and grow together.

Our Values

• Connected
• Committed
• Trustworthy
• Safe

Our Employee Commitments

• Work that makes a difference
• A team you can count of
• Opportunities to grow
• Rewards that help you thrive

Xcel Energy provides job applicants reasonable accommodations for disabilities throughout the application process.

If you are in need of an accommodation to complete the application process, now or at any time in the future, please complete the Applicant Accommodation Request Form.

In any materials you submit, you may redact or remove age-identifying information including but not limited to dates of school attendance and graduation. You will not be penalized for redacting or removing this information.

The anticipated starting base pay for this position is: $84,900.00 to $120,566.00 per year

Benefits

• Annual Incentive Program
• Medical/Pharmacy Plan
• Dental
• Vision
• Life Insurance
• Dependent Care Reimbursement Account
• Health Care Reimbursement Account
• Health Savings Account (HSA) (if enrolled in eligible health plan)
• Limited-Purpose FSA (if enrolled in eligible health plan and HSA)
• Transportation Reimbursement Account
• Short-term disability (STD)
• Long-term disability (LTD)
• Employee Assistance Program (EAP)
• Fitness Center Reimbursement (if enrolled in eligible health plan)
• Tuition reimbursement
• Transit programs
• Employee recognition program
• Pension
• 401(k) plan
• Paid time off (PTO)
• Holidays
• Volunteer Paid Time Off (VPTO)
• Parental Leave

Benefit plans are subject to change and Xcel Energy has the right to end, suspend, or amend any of its plans, at any time, in whole or in part.

All Xcel Energy employees and contractors share responsibility for protecting the company's information and systems by adhering to cybersecurity policies, standards, and best practices, recognizing that cybersecurity is everyone's responsibility.

We're committed to leading with equity and inclusion.

We're committed to hiring a workforce that reflects the communities we serve.

At Xcel Energy, we’re more than an energy company. We’re reinventing how we power communities. Redefining how we care for customers. Reaffirming our commitment to the planet. We’re committed to leading with equity and inclusion. You’re not waiting for change - you’re creating it. You’re driven to protect the environment, support your community, and seek innovation. You want a career that grows with you and an employer who values you. You are reliable, trustworthy and bring integrity to everything you do. We are leading the way in clean energy. We’re using technology and innovation in every facet of our company. We’re providing safe, stable jobs with robust benefits. We keep our customers at the center of all we do. We’re committed to hiring a workforce that reflects the communities we serve. Together, we can provide carbon-free electricity by 2050. Together, we can take care of the environment and our communities. Together, we can create a place where everyone belongs. Together we’re building a better tomorrow.