NextGenEnergyJobsModern Power System Jobs

Security Engineer - Multi-Cloud Security

Xcel Energy

Denver, CO

Full Time

Posted October 27, 2026

$98k - $139k

Utilities

Apply Now

Application opens on company website

Listing evidence and provenance

Source: Workday View original listing
Freshness: Open in the current public read path; this is not an employer guarantee.Last observed October 28, 2026
Classification: Modern power-system classification not yet published for this listing.Legacy source industry field: Utilities
Pay provenance: Employer-provided pay

Job Description

The Security Engineer - Multi-Cloud Security is responsible for building and running the cloud security program with a focus on reducing risk through visibility, guardrails, and automation.

Key Responsibilities

Serve as a primary cloud security engineer with deep expertise in either AWS or GCP. AWS expertise is preferred. Azure familiarity is a plus.
Use cloud-native security capabilities such as AWS Inspector, AWS Security Hub, Microsoft Defender for Cloud, Google Security Command Center, and related services to identify and analyze risk.
Maintain visibility across identity and access management, network configuration, logging, monitoring, and workload security posture.
Identify issues such as overly permissive access, unused accounts, misconfigurations, and exposure risks.
Develop and implement guardrails, policies, and controls to prevent insecure configurations and reduce attack surface.
Promote the use of hardened images, containers, and standardized builds to reduce risk at deployment.
Integrate cloud security findings into existing workflows and coordinate remediation with responsible teams.
Experience supporting ownership-accountability-first remediation models.
Work closely with Cloud Platform, SAP, Enterprise Architecture, and other teams to implement meaningful security improvements.
Partner with Application Security teams to support DevSecOps practices, including CI/CD pipeline integration, gates, and automation.
Support SAP cloud security needs and maintain awareness of SAP-specific risks within cloud-hosted environments.
Use APIs, scripting, and integration to automate data collection, analysis, and workflow execution.
Analyze cloud risk in context and communicate clear, actionable recommendations to stakeholders.
Support logging and monitoring capability setup and integration while deferring operational ownership to SOC/IR teams.

Requirements

Minimum 5 years of experience in cloud security.
Expert-level hands-on experience in either AWS or GCP. AWS expertise is preferred.
Ability to transfer cloud security concepts across providers. Azure familiarity is nice to have but is not required.
Strong understanding of cloud identity and access management, networking, logging, monitoring, and workload security.
Experience using native cloud security tools or equivalent capabilities in AWS or GCP.
Strong understanding of DevSecOps principles, CI/CD pipelines, and application security fundamentals.
Basic understanding of SAP environments in cloud-hosted architectures.
Experience identifying and communicating risk related to cloud configurations and architecture.
Strong analytical and complex technical problem-solving skills.
Ability to communicate technical risk clearly to non-technical stakeholders.
Experience with APIs, scripting, or automation for data integration and workflow execution.
Ability to operate independently and build a program with limited oversight.
Deep AWS security experience, including multi-account and GovCloud architectures, or deep GCP security experience.
Experience supporting security across more than one cloud platform; Azure experience is a plus.
Experience implementing preventative security controls such as guardrails, policy enforcement, or pipeline gating.
Experience improving data quality and visibility across multiple cloud and security data sources.
Experience working with enterprise cloud platform, networking, or architecture teams.
Experience with Qualys Cloud Security Posture Management (CSPM).
Experience supporting attribution-driven remediation governance frameworks.