Senior Security and Compliance Analyst

Xcel Energy (NASDAQ: XEL) is a leading energy provider and Fortune 500 company, dedicated to serving millions of electricity and natural gas customers across eight states: Minnesota, Colorado, Wisconsin, Michigan, North Dakota, South Dakota, New Mexico and Texas. We make energy work better for our customers, helping them thrive every day. That means always raising the bar - delivering better service and providing more reliable, resilient, and sustainable energy.  Xcel Energy is a place where you’ll have opportunities to grow, expand your skills, and help lead the clean energy transition. We offer meaningful rewards, recognition, and support to help you build your career and make an impact - both on the job and beyond. Most importantly, it means you’ll be joining a company that knows employees are the driving force behind its success and is committed to helping you be your best.   Xcel Energy supports a hybrid work model to enable collaboration and flexibility. Many roles are expected to work onsite three days per week (Tuesday–Thursday); however, work location expectations vary based on role, team, and business needs.

Summary As a Senior Security Governance and Controls Analyst, you will be responsible for contributing to the develop of and the execution of the security governance and control program focused on security policies and standards, security controls assurance program, training and awareness, and metrics and reporting. Security controls assurance involves the development and evaluation of security controls, self-assessments, and spot-checks. Partners across the security organization, as well as other business units, to facilitate the adoption of security controls. Contributes to the organizational continuous improvement program, driving consistency and quality across the organization.  In addition, designated as a regulation security liaison.  A liaison is the business area point of contact for managing, coordinating or facilitating regulatory compliance operations within the business area.

PROGRAM DEVELOPMENT & MAINTENANCE: Lead the development and implementation of the department's policy and compliance governance program and supporting procedures documentation. Ensure security standard requirements are mapped to key regulations and frameworks.  Establish relationships and partner with industry and business unit subject matter experts to identify and document new requirements and supporting controls. Maintain enterprise security standards in eGRC system to support downstream processes (i.e., Issue Management and Exceptions and Security Assurance (control testing)). Contribute to the development and implementation of the compliance assurance program and supporting procedure documentation. Lead the development and implementation of the CIP compliance management program and supporting procedure documentation. PROGRAM EXECUTION (OPERATIONS): Significant contributor to the execution of security governance program focused on security policies and security standards lifecycle.  Lead in the review and update cycles for security policies and security standards with respective owner and subject matter experts. This includes developing a review schedule, assigning responsibilities within team and service teams. Lead in the development and evaluation of security controls, self-assessments, spot-checks, risk identification, process gaps, and process alignment. Contributes to the organizational continuous improvement program, driving consistency and quality across the organization.  Stay current on relevant industry security threat landscape, changes in security frameworks (i.e., NIST CSF, other NIST as applicable), and in scope regulations (i.e., NERC CIP, DHS TSA, and SOX). PROGRAM METRICS & REPORTING: Compile and review output from security controls assessment program. Work with leads to analyze information and formulate recommendations and