Security Governance and Controls Analyst

Xcel Energy

. Develop, implement, and execute the Policy and Compliance governance program and supporting process documentation .

Posted 11/11/2026full-timeUnited StatesMid-LevelSenior💰 $73,700 - $104,633 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in developing and executing Policy and Compliance governance programs, with a strong focus on security policy implementation, control assessments, and risk management in regulated environments. Proficient in analyzing security requirements and formulating actionable recommendations for management.

Highest-signal resume keywords

Governance Risk Compliance (GRC)Security Policy ImplementationControl TestingRisk ManagementSecurity Audits

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Control AssessmentSecurity StandardsIdentity and Access ManagementData ExtractionSecurity Risk ManagementNetwork AdministrationSystems AdministrationTechnical Security FunctionPhysical Access ControlsDocumentation Creation

Soft Skills

Strong Verbal CommunicationStrong Written CommunicationAdaptabilityRelationship BuildingGoal Setting

Tools & Technologies

GRC Tool (Archer)Security FrameworksSOX ComplianceCyber Security Framework (CSF)NIST CSF

Certifications & Qualifications

CISMCISSPCISACRISCSecurity+CPPPSP

Industry Keywords

PCINERC CIPDHS TSAHIPAAISONISTCOBIT

Tech Stack

Tools & technologies

Cyber SecuritySDLC

About the role

Key responsibilities & impact

Develop, implement, and execute the Policy and Compliance governance program and supporting process documentation
Review and update security policies, procedures, standards, and controls
Map security requirements to in-scope regulations and frameworks
Engage in control assessment activities with Enterprise Security Services and business units
Schedule and execute security self-assessments and spot checks
Assess control activities, document gaps and system vulnerabilities, and identify risks
Work with the Risk Management team to input risks into the Risk Management process
Compile and review security control assessment outputs
Analyze information and formulate recommendations and reports for management review and decision-making
Participate in developing and implementing governance-program training, materials, and events
Execute daily, weekly, and quarterly identity control checks for SOX and internal security frameworks
Deploy and operate technical assurance processes to identify access anomalies, orphaned accounts, and segregation-of-duty violations
Partner with Run and Build teams to remediate gaps and close vulnerabilities before audit findings
Compile, validate, and maintain evidence and documentation for internal and external regulatory audits
Interface with enterprise security, including cybersecurity, physical security, and enterprise resilience, and other business areas
Perform other duties as assigned

Requirements

What you’ll need

Bachelor's degree or equivalent education, military and/or law enforcement or Corporate Security experience providing equivalent knowledge
Three years of experience in physical security or security IT or OT related fields
Two years of experience with control testing, security standards/policy implementation, security audits, or a technical security function
One year of working in a Governance Risk Compliance (GRC) function in a regulated environment (i.e. Utilities)
Self-starter; adaptable to change; inquisitive
Ability to set and achieve personal and program goals, and to track performance against those goals
Ability to develop positive working relationships and work across different areas of the business
Strong verbal and written communication skills
Demonstrated ability to create documentation for technical and non-technical audiences
Preferred: experience in physical access controls, network administration, systems administration, SDLC / secure soft, encryption, asset management, identity and access management, IT or OT operations, security risk management
Preferred: certification in CISM, CISSP, CISA, CRISC, Security+, CPP or PSP
Preferred: experience using a GRC tool (i.e. Archer)
Preferred: knowledge of PCI, NERC CIP, DHS TSA, SOX, HIPPA, NIST CSF, NIST-800-37
Preferred: working knowledge of ISO, NIST, COBIT, or Cyber Security Framework (CSF)
Preferred: experience with data extraction, analysis and reporting

Benefits

Comp & perks

Annual Incentive Program
Medical/Pharmacy Plan
Dental
Vision
Life Insurance
Dependent Care Flexible Spending Account
Health Care Flexible Spending Account
Health Savings Account (HSA) (if enrolled in eligible health plan)
Limited-Purpose FSA (if enrolled in eligible health plan and HSA)
Transportation Reimbursement Account
Short-term disability (STD)
Long-term disability (LTD)
Employee Assistance Program (EAP)
Fitness Center Reimbursement (if enrolled in eligible health plan)
Tuition reimbursement
Transit programs
Employee recognition program
Pension
401(k) plan
Paid time off (PTO)
Holidays
Volunteer Paid Time Off (VPTO)
Parental Leave
Hybrid work model supporting collaboration and flexibility