Security Governance and Controls Analyst

Xcel Energy (NASDAQ: XEL) is a leading energy provider and Fortune 500 company, dedicated to serving millions of electricity and natural gas customers across eight states: Minnesota, Colorado, Wisconsin, Michigan, North Dakota, South Dakota, New Mexico and Texas. We make energy work better for our customers, helping them thrive every day. That means always raising the bar - delivering better service and providing more reliable, resilient, and sustainable energy. Xcel Energy is a place where you’ll have opportunities to grow, expand your skills, and help lead the clean energy transition. We offer meaningful rewards, recognition, and support to help you build your career and make an impact - both on the job and beyond. Most importantly, it means you’ll be joining a company that knows employees are the driving force behind its success and is committed to helping you be your best. Xcel Energy supports a hybrid work model to enable collaboration and flexibility. Many roles are expected to work onsite three days per week (Tuesday–Thursday); however, work location expectations vary based on role, team, and business needs. Position Summary As a Functional Security Governance and Controls Analyst, you will be responsible for aspects of the security governance program that addresses security policies, security standards, training and awareness, metrics, and reporting. Drive the development and evaluation of security controls, self-assessments, spot-checks, risk identification, process gaps, and process alignment. Interface with the enterprise security organization, including cyber security, physical security, and enterprise resilience, as well as across other business areas, to assess organizational alignment to security controls. Essential Responsibilities • PROGRAM DEVELOPMENT & MAINTENANCE: Contribute to the development, implementation and execution of the Policy and Compliance governance program and supporting processes documentation. Participate in the review and update cycle for security policies, procedures, standards, and controls. Ensure security requirements are mapped to in scope regulations and frameworks. • PROGRAM EXECUTION (OPERATIONS) : Engage in control assessment activities with Enterprise Security Services and the business units, addressing a range of security and regulatory requirements that are both technical and functional in nature. Assist with the scheduling and execution of security self-assessments and spot checks, and the assessment of control activities. Under the direction of team leads, document gaps and system vulnerabilities, identify risks and work with the Risk Management team to properly input risks into the Risk Management process. • PROGRAM METRICS & REPORTING : Compile and review output from security controls assessment program. Work with leads to analyze information and formulate recommendations and reports for management review and decision making. • PROGRAM TRAINING AND AWARENESS: Participate in the development and implementation of training, training materials, and events related to the ESS Governance Program. • Other duties as assigned. • Control Performance & Monitoring: Execute daily, weekly, and quarterly identity control checks to ensure strict adherence to SOX and internal security frameworks. • Assurance Capability Execution: Deploy and operate new technical assurance processes designed to proactively identify access anomalies, orphaned accounts, and segregation of duty (SoD) violations. • Environment Hardening: Partner closely with the "Run" and "Build" teams to remediate identified gaps, ensuring vulnerabilities are closed before they result in audit findings. • Audit Readiness: Compile, validate, and maintain high-fidelity evidence and documentation required for internal and external regulatory audits. Minimum Requirements • Bachelor's degree or equivalent education, military and/or law enforcement or Corporate Security experience providing equivalent knowledge. • Three years of experience in physical security or security IT or OT related fields. • Two years of experience with control testing, security standards/policy implementation, security audits, or a technical security function. • One year of working in a Governance Risk Compliance (GRC) function in a regulated environment (i.e. Utilities). • Self-starter; adaptable to change; inquisitive. • Ability to set and achieve personal and program goals, and to track performance against those goals. • Ability to develop positive working relationships, and work across different areas of the business. Can make connections and sound decisions based on known information. • Strong verbal and written communication skills. • Demonstrated ability to create documentation for technical and non-technical audiences. Preferred Requirements • Experience in one or more of the following areas: physical access controls, network administration, systems administration, SDLC / secure soft, encryption, asset management, identity and access management, IT or OT operations, security risk management. • Certification in one or more of the following: CISM, CISSP, CISA, CRISC, Security+, CPP or PSP. • Experience using a GRC tool (i.e. Archer) • Knowledge of regulatory requirements and frameworks such as PCI, NERC CIP, DHS TSA, SOX, HIPPA, NIST CSF, NIST-800-37. • Working knowledge of one or more control frameworks, including ISO, NIST, COBIT, or Cyber Security Framework (CSF). • Experience with data extraction, analysis and reporting Our culture is grounded in shared values and employee commitments that guide how we work, support one another, and grow together. Our Values Connected, Committed, Trustworthy, Safe Our Employee Commitments • Work that makes a difference • A team you can count of • Opportunities to grow • Rewards that help you thrive Xcel Energy provides job applicants reasonable accommodations for disabilities throughout the application process. If you are in need of an accommodation to complete t