Security Governance and Controls Analyst
Xcel EnergyDenver, CO
Full Time
Posted November 10, 2026
$74k - $105k
Apply Now
Application opens on company website
Listing evidence and provenance
- Source
- Workday View original listing
- Freshness
- Open in the current public read path; this is not an employer guarantee.Last observed November 11, 2026
- Classification
- Modern power-system classification not yet published for this listing.Legacy source industry field: Utilities
- Pay provenance
- Employer-provided pay
Job Description
Connected, Committed, Trustworthy, Safe
Key Responsibilities
- As a Functional Security Governance and Controls Analyst, you will be responsible for aspects of the security governance program that addresses security policies, security standards, training and awareness, metrics, and reporting. Drive the development and evaluation of security controls, self-assessments, spot-checks, risk identification, process gaps, and process alignment. Interface with the enterprise security organization, including cyber security, physical security, and enterprise resilience, as well as across other business areas, to assess organizational alignment to security controls.
- PROGRAM DEVELOPMENT & MAINTENANCE: Contribute to the development, implementation and execution of the Policy and Compliance governance program and supporting processes documentation. Participate in the review and update cycle for security policies, procedures, standards, and controls. Ensure security requirements are mapped to in scope regulations and frameworks.
- PROGRAM EXECUTION (OPERATIONS) : Engage in control assessment activities with Enterprise Security Services and the business units, addressing a range of security and regulatory requirements that are both technical and functional in nature. Assist with the scheduling and execution of security self-assessments and spot checks, and the assessment of control activities. Under the direction of team leads, document gaps and system vulnerabilities, identify risks and work with the Risk Management team to properly input risks into the Risk Management process.
- PROGRAM METRICS & REPORTING : Compile and review output from security controls assessment program. Work with leads to analyze information and formulate recommendations and reports for management review and decision making.
- PROGRAM TRAINING AND AWARENESS: Participate in the development and implementation of training, training materials, and events related to the ESS Governance Program.
- Other duties as assigned.
- Control Performance & Monitoring: Execute daily, weekly, and quarterly identity control checks to ensure strict adherence to SOX and internal security frameworks.
- Assurance Capability Execution: Deploy and operate new technical assurance processes designed to proactively identify access anomalies, orphaned accounts, and segregation of duty (SoD) violations.
- Environment Hardening: Partner closely with the "Run" and "Build" teams to remediate identified gaps, ensuring vulnerabilities are closed before they result in audit findings.
- Audit Readiness: Compile, validate, and maintain high-fidelity evidence and documentation required for internal and external regulatory audits.
Requirements
- Bachelor's degree or equivalent education, military and/or law enforcement or Corporate Security experience providing equivalent knowledge.
- Three years of experience in physical security or security IT or OT related fields.
- Two years of experience with control testing, security standards/policy implementation, security audits, or a technical security function.
- One year of working in a Governance Risk Compliance (GRC) function in a regulated environment (i.e. Utilities).
- Self-starter; adaptable to change; inquisitive.
- Ability to set and achieve personal and program goals, and to track performance against those goals.
- Ability to develop positive working relationships, and work across different areas of the business. Can make connections and sound decisions based on known information.
- Strong verbal and written communication skills.
- Demonstrated ability to create documentation for technical and non-technical audiences.
- Experience in one or more of the following areas: physical access controls, network administration, systems administration, SDLC / secure soft, encryption, asset management, identity and access management, IT or OT operations, security risk management.
- Certification in one or more of the following: CISM, CISSP, CISA, CRISC, Security+, CPP or PSP.
- Experience using a GRC tool (i.e. Archer)
- Knowledge of regulatory requirements and frameworks such as PCI, NERC CIP, DHS TSA, SOX, HIPPA, NIST CSF, NIST-800-37.
- Working knowledge of one or more control frameworks, including ISO, NIST, COBIT, or Cyber Security Framework (CSF).
- Experience with data extraction, analysis and reporting
- Our culture is grounded in shared values and employee commitments that guide how we work, support one another, and grow together.
Ready to Apply?
Apply directly on Xcel Energy's site
Get new power and energy jobs weekly
New jobs across data centers, grid, nuclear, storage, generation, and renewables. One email a week.
Job Alerts
Get alerts for jobs like this one
More at Xcel Energy
Similar Jobs
More jobs at Xcel Energy
Similar jobs in Utilities
SI
More jobs in Denver, CO
SI
