Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted yesterday

Security Governance and Controls Analyst

Xcel Energy117 open roles

Pay
$73,700 – $104,633 a year
Where
Denver CO 80205
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSecurity Governance and Controls AnalystXcel Energy · Denver CO 80205

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Xcel Energy's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.8% of postings close within 7 days. Measured by our own scanner across the market. Xcel Energy postings stay open a median of 31 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 13.8%7 days
  4. 22.3%14 days
  5. 37.8%30 days
  6. 59.0%60 days
This job: posted yesterday

Xcel Energy median: 31 days open

The posting

Xcel Energy (NASDAQ: XEL) is a leading energy provider and Fortune 500 company, dedicated to serving millions of electricity and natural gas customers across eight states: Minnesota, Colorado, Wisconsin, Michigan, North Dakota, South Dakota, New Mexico and Texas. We make energy work better for our customers, helping them thrive every day. That means always raising the bar - delivering better service and providing more reliable, resilient, and sustainable energy.

Xcel Energy is a place where you’ll have opportunities to grow, expand your skills, and help lead the clean energy transition. We offer meaningful rewards, recognition, and support to help you build your career and make an impact - both on the job and beyond. Most importantly, it means you’ll be joining a company that knows employees are the driving force behind its success and is committed to helping you be your best.

Xcel Energy supports a hybrid work model to enable collaboration and flexibility. Many roles are expected to work onsite three days per week (Tuesday–Thursday); however, work location expectations vary based on role, team, and business needs.

Position Summary

As a Functional Security Governance and Controls Analyst, you will be responsible for aspects of the security governance program that addresses security policies, security standards, training and awareness, metrics, and reporting. Drive the development and evaluation of security controls, self-assessments, spot-checks, risk identification, process gaps, and process alignment. Interface with the enterprise security organization, including cyber security, physical security, and enterprise resilience, as well as across other business areas, to assess organizational alignment to security controls.

Essential Responsibilities

  • PROGRAM DEVELOPMENT & MAINTENANCE: Contribute to the development, implementation and execution of the Policy and Compliance governance program and supporting processes documentation. Participate in the review and update cycle for security policies, procedures, standards, and controls. Ensure security requirements are mapped to in scope regulations and frameworks.
  • PROGRAM EXECUTION (OPERATIONS): Engage in control assessment activities with Enterprise Security Services and the business units, addressing a range of security and regulatory requirements that are both technical and functional in nature. Assist with the scheduling and execution of security self-assessments and spot checks, and the assessment of control activities. Under the direction of team leads, document gaps and system vulnerabilities, identify risks and work with the Risk Management team to properly input risks into the Risk Management process.
  • PROGRAM METRICS & REPORTING: Compile and review output from security controls assessment program. Work with leads to analyze information and formulate recommendations and reports for management review and decision making.
  • PROGRAM TRAINING AND AWARENESS: Participate in the development and implementation of training, training materials, and events related to the ESS Governance Program.
  • Other duties as assigned.
  • Control Performance & Monitoring: Execute daily, weekly, and quarterly identity control checks to ensure strict adherence to SOX and internal security frameworks.
  • Assurance Capability Execution: Deploy and operate new technical assurance processes designed to proactively identify access anomalies, orphaned accounts, and segregation of duty (SoD) violations.
  • Environment Hardening: Partner closely with the "Run" and "Build" teams to remediate identified gaps, ensuring vulnerabilities are closed before they result in audit findings.
  • Audit Readiness: Compile, validate, and maintain high-fidelity evidence and documentation required for internal and external regulatory audits.

Minimum Requirements

  • Bachelor's degree or equivalent education, military and/or law enforcement or Corporate Security experience providing equivalent knowledge.
  • Three years of experience in physical security or security IT or OT related fields.
  • Two years of experience with control testing, security standards/policy implementation, security audits, or a technical security function.
  • One year of working in a Governance Risk Compliance (GRC) function in a regulated environment (i.e. Utilities).
  • Self-starter; adaptable to change; inquisitive.
  • Ability to set and achieve personal and program goals, and to track performance against those goals.
  • Ability to develop positive working relationships, and work across different areas of the business. Can make connections and sound decisions based on known information.
  • Strong verbal and written communication skills.
  • Demonstrated ability to create documentation for technical and non-technical audiences.

Preferred Requirements

  • Experience in one or more of the following areas: physical access controls, network administration, systems administration, SDLC / secure soft, encryption, asset management, identity and access management, IT or OT operations, security risk management.
  • Certification in one or more of the following: CISM, CISSP, CISA, CRISC, Security+, CPP or PSP.
  • Experience using a GRC tool (i.e. Archer)
  • Knowledge of regulatory requirements and frameworks such as PCI, NERC CIP, DHS TSA, SOX, HIPPA, NIST CSF, NIST-800-37.
  • Working knowledge of one or more control frameworks, including ISO, NIST, COBIT, or Cyber Security Framework (CSF).
  • Experience with data extraction, analysis and reporting

Our culture is grounded in shared values and employee commitments that guide how we work, support one another, and grow together.

Our Values

Connected, Committed, Trustworthy, Safe

Our Employee Commitments

  • Work that makes a difference
  • A team you can count of
  • Opportunities to grow
  • Rewards that help you thrive

Xcel Energy provides job applicants reasonable accommodations for disabilities throughout the application process. If you are in need of an accommodation to complete the application process, now or at any time in the future, please complete the Applicant Accommodation Request Form.

Non-Bargaining

The anticipated starting base pay for this position is: $73,700.00 to $104,633.33 per year

This position is eligible for the following benefits: Annual Incentive Program, Medical/Pharmacy Plan, Dental, Vision, Life Insurance, Dependent Care Flexible Spending Account, Health Care Flexible Spending Account, Health Savings Account (HSA) (if enrolled in eligible health plan), Limited-Purpose FSA (if enrolled in eligible health plan and HSA), Transportation Reimbursement Account, Short-term disability (STD), Long-term disability (LTD), Employee Assistance Program (EAP), Fitness Center Reimbursement (if enrolled in eligible health plan), Tuition reimbursement, Transit programs, Employee recognition program, Pension, 401(k) plan, Paid time off (PTO), Holidays, Volunteer Paid Time Off (VPTO), Parental Leave

Benefit plans are subject to change and Xcel Energy has the right to end, suspend, or amend any of its plans, at any time, in whole or in part.

In any materials you submit, you may redact or remove age-identifying information including but not limited to dates of school attendance and graduation. You will not be penalized for redacting or removing this information.

Deadline to Apply: 12/07/26

EEO is the Law (PDF) | Equal Opportunity Statement (PDF) | Employee Rights (PDF)

All Xcel Energy employees and contractors share responsibility for protecting the company's information and systems by adhering to cybersecurity policies, standards, and best practices, recognizing that cybersecurity is everyone's responsibility.

Accessibility Statement

Xcel Energy endeavors to make https://www.xcelenergy.com and https://jobs.xcelenergy.com accessible to any and all users. If you are in need of an accommodation to complete the application process, now or at any time in the future, please complete the Applicant Accommodation Request Form. For any other application related questions, including application follow-ups or technical issues, please use our Recruiting Assistance, Electra, for assistance. Electra can be found in the lower right-hand corner of our Xcel Energy Careers site.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Xcel Energy's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Xcel Energy's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Xcel Energy's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.