Managing Director - OT Security

Job Posting End Date 11-11-2026

Please note the job posting will close on the day before the posting end date.

Job Summary

The Managing Director, OT Security provides senior leadership for the cybersecurity strategy, operating model, services, and risk outcomes protecting operational technology across AEP's Transmission, Distribution, and Generation fleet, including nuclear generation in coordination with the licensed nuclear cybersecurity program. The role leads a shared-services OT Security organization and aligns priorities, investment, talent, and delivery with business-unit operational needs, enterprise cybersecurity strategy, NERC CIP, NRC, and internal cybersecurity requirements, and the safety, reliability, and resilience expectations of critical infrastructure.

This leader must bring deep, practical understanding of the business of electricity generation, transmission, distribution, and how electricity systems are protected from cyber threats. The Managing Director is accountable for ensuring OT Security group can define security requirements, lead architecture and engineering efforts, validate security outcomes, prioritize vulnerability risk, integrate monitoring and detection, coordinate OT incident response and recovery, assess technology, maintain trusted Business Unit partnerships, and build missing OT security capabilities. The role operates through established enterprise authorities and leverages Enterprise Security capabilities rather than duplicating them.

Please note: This position is 100% onsite in either Columbus, OH or Austin, TX

Job Description

What you’ll do:

Leadership Accountabilities

• Set and communicate the OT Security vision, strategy, priorities, service model, and multi-year direction across the in-scope operational technology environment.
• Provide executive leadership for the OT Security portfolio and its persistent services, ensuring clear ownership, quality, prioritization, integration, performance, and measurable risk reduction.
• Align OT cybersecurity priorities and investment with Transmission, Distribution, Generation, and Nuclear leaders, Enterprise Security, enterprise risk and governance functions, operational reliability requirements, and regulatory obligations.
• Establish clear accountability, delegated decision authority, engagement boundaries, escalation paths, and operating expectations across OT Security, Business Units, Enterprise Security, projects, vendors, and other service owners.
• Guide portfolio demand, capacity, organizational design, talent strategy, and sourcing based on risk, service health, planned outages, incidents, delivery performance, emerging threats, and business demand.
• Ensure material OT cyber risk, unresolved control gaps, readiness concerns, dependencies, and ownership conflicts are transparent to senior leadership and escalated through authorized governance paths.
• Maintain the technical depth and credibility to challenge high-consequence engineering and security conclusions, and sponsor consistent technical-review, validation, and quality practices.
• Build durable executive partnerships with Business Unit and Enterprise Security leaders so OT security work aligns to operating cadence, work authorization, safety, change management, maintenance, and incident processes.
• Develop leaders and a multidisciplinary OT cybersecurity team with succession depth, cross-training, delegated authority, strong technical judgment, and clear primary and secondary coverage.
• Represent OT cybersecurity in senior governance forums and serve as a senior advisor to executive leadership and the Board on operational cyber risk, capability gaps, technology choices, resilience, and security investment.

Operational Technology Domain Expertise

The Managing Director must bring deep, practical understanding of how the electric system is operated and protected, from generation through transmission and distribution to the customer, including one or more of the functional areas below:

• Transmission: EMS/SCADA, control centers, substations and substation automation, protective relaying, ICCP and inter-utility communications, and Reliability Coordinator/RTO interdependencies.
• Distribution: ADMS/DMS/OMS, distribution automation, AMI, DER integration, field area networks, and grid-edge devices.
• Generation: Plant DCS, PLCs, safety instrumented systems, turbine, boiler, and emissions controls across fossil, gas, hydro, and renewable facilities.

Additional experience in the following area(s) considered a plus:

• Nuclear: Nuclear plant digital instrumentation and control, 10 CFR 73.54, NEI 08-09, and Regulatory Guide 5.71; ability to partner effectively with nuclear leadership, operations, and the licensed cybersecurity program.
• Standards: OT Specific protocols such as DNP3, IEC 61850, Modbus, ICCP/TASE.2, IEC 62443, and related ISA/IEC standards, along with OT-specific threats and adversaries known to target grid systems.

OT Security Portfolio and Services

The Managing Director provides portfolio leadership and operating accountability for the following persistent OT Security services across Transmission, Distribution, Generation, and Nuclear.

• Security Requirements & Standards
• Architecture & Design
• Validation & Assurance
• Vulnerability Management & Risk Prioritization
• Monitoring & Detection Integration
• Incident Response & Recovery
• Security Partnership
• Technology Assessment
• OT Capability Development

Operating, Risk, and Partnership Responsibilities

• Maintain enterprise-level visibility into OT Security commitments, priorities, dependencies, findings, and decisions, and ensure significant risks are visible to senior leadership.
• Lead an intake and engagement model that empowers qualified specialists to act within delegated authority while keeping consequential commitments transparent and controlled.
• Prioritize competing demand across Business Units, projects, outages, incidents, vulnerability work, and capability development, preventing unsupported scope expansion or unintended transfer of operational ownership.
• Ensure work closes with a clear outcome: validated completion, tracked remediation, accepted risk, authorized deferral, or documented escalation.
• Ensure enterprise cybersecurity capabilities are adapted to OT requirements where technically feasible and independently validated before operational use; determine the appropriate enduring owner for new capabilities.
• Govern planned after-hours support, incident escalation, site stabilization guidance, and any approved on-call model while preserving Business Unit authority for operational decisions and work authorization.
• Intervene in high-consequence, novel, disputed, or cross-functional matters and support withholding security endorsement when material requirements are unmet and no supportable disposition exists.
• Lead OT supply chain and vendor security risk management with OEMs, integrators, and service providers, including NERC CIP-013 and emerging federal Bulk Power System supply chain requirements.
• Drive secure remote access, OT identity and access management, network segmentation, and internal network security monitoring, including NERC CIP-015.
• Ensure OT backup, recovery, and restoration capabilities support operating in degraded conditions and timely return to service.
• Integrate cyber and physical security for substations, control centers, and generating stations, including nuclear facilities.
• Ensure new grid technologies (DER, AMI, distribution automation, AI in OT, and OT digital twin capabilities) are secured by design.
• Represent AEP with E-ISAC, DOE, CISA, NRC, NERC, and industry peers, and participate in GridEx and sector exercises.
• Establish OT security metrics and deliver clear, executive-ready risk reporting to senior leadership and the Board.

Expected Results

• A clear, enterprise-aligned OT Security strategy, service portfolio, operating model, and multi-year capability roadmap.
• Material OT cyber risk is reduced or formally dispositioned, controls and services are validated, and incident and recovery readiness improves.
• Transmission, Distribution, Generation, and Nuclear leaders have trusted OT Security partners, predictable engagement, clear responsibilities, and effective escalation.
• NERC CIP and NRC cybersecurity obligations are met, and OT recovery and restoration readiness is demonstrated through exercises.
• Demand, priorities, investment needs, scope, dependencies, and blockers are visible; work reaches formal disposition and leadership decisions are supported by credible evidence.
• Enterprise Security reachback is effective, unnecessary duplication is minimized, enterprise capabilities work appropriately in OT, and ownership transitions succeed.
• Capability depth, leadership bench strength, cross-training, and succession improve while single points of failure decline.
• Measurable improvement in the maturity, reliability, scalability, and sustainability of persistent OT Security services.

Experience and Leadership Capabilities

• Progressive leadership experience across cybersecurity, operational technology, engineering, critical infrastructure, technology operations, risk, or closely related disciplines.
• Experience setting strategy and leading complex programs, portfolios, services, or multidisciplinary teams in a large, regulated, operationally sensitive, or critical-infrastructure environment.
• Demonstrated ability to balance cybersecurity outcomes with operational safety, reliability, availability, maintainability, regulatory obligations, and business priorities.
• Ability to lead through influence across organizational boundaries, resolve accountability or ownership ambiguity, and communicate material risk to senior and executive leaders.
• Experience establishing priorities, delegated authority, governance, service expectations, talent plans, and sustainable operating models across competing demand.
• Hands-on OT and cybersecurity depth sufficient to evaluate technical quality, challenge engineering and security conclusions, and lead high-consequence decisions in live operating environments.
• Experience building or maturing security capabilities and working with operational leaders, engineering teams, enterprise cybersecurity service owners, project organizations, governance functions, vendors, and executive stakeholders.

What we’re looking for:

• Bachelor's degree in engineering, computer science, or a related field; equivalent combinations of education, military service, and operational experience will be considered.
• 15+ years of progressive experience in cybersecurity, operational technology, engineering, or operations, including 7+ years in senior leadership.
• Required: direct experience securing electric utility operational environments across multiple areas of transmission, distribution, and generation.
• Required: demonstrated expertise in NERC CIP compliance and OT security architecture, monitoring, vulnerability management, and incident response.
• S trongly preferred: nuclear power plant cybersecurity experience or direct work with NRC cybersecurity programs.
• Preferred: engineering or operations background (e.g., protection and control, SCADA, plant controls) and certifications such as GICSP, GRID, GCIP, or CISSP.

Leadership Decisions Affecting Final Requisition

• Final reporting relationship, corporate job code, salary grade, location, travel percentage, and approved HR qualification language.
• Final organization structure and number/level of direct reports, including whether service-delivery or deputy leadership is part of the model.
• Approved after-hours and on-call model and associated HR requirements.
• Nuclear accountability model (direct accountability or oversight and integration) defined with Nuclear leadership, consistent with NRC license obligations.

Why This Role Matters

Operational technology is foundational to the safe and reliable delivery of electric service. The Managing Director, OT Security ensures AEP has senior, accountable, and technically credible leadership for the cyber risk, services, partnerships, and capabilities that protect our transmission, distribution, and generation fleet, including nuclear, while preserving the operating authority of the Business Units and leveraging enterprise cybersecurity capabilities.

American Electric Power (On-Site)

#LI-Onsite

#AEPCareers

At AEP, we’re more than just an energy company — we’re a team of dedicated professionals committed to delivering safe, reliable, and innovative energy solutions. Guided by our mission to put the customer first, we strive to exceed expectations by listening, responding, and continuously improving the way we serve our communities. If you're passionate about making a meaningful impact and being part of a forward-thinking organization, this is the company for you!

Compensation Data

Compensation Grade:

SP20-012

Compensation Range:

$188,524.00 - $245,080.00

The Physical Demand Level for this job is: S – Sedentary Work: Exerting up to 10 pounds of force occasionally (Occasionally: activity or condition exists up to 1/3 of the time) and/or a negligible amount of force frequently. (Frequently: activity or condition exists from 1/3 to 2/3 of the time) to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time but may involve walking or standing for brief periods of time. Jobs are sedentary if walking and standing are required only occasionally, and all other sedentary criteria are met.

Hear about it first! Get job alerts by email. Log in to your Candidate Home Account today! If you don't have an account, you can create one.

It is hereby reaffirmed that it is the policy of American Electric Power (AEP) to provide Equal Employment Opportunity in all respects of the employer-employee relationship including recruiting, hiring, upgrading and promotion, conditions and privileges of employment, company sponsored training programs, educational assistance, social and recreational programs, compensation, benefits, transfers, discipline, layoffs and termination of employment to all employees and applicants without discrimination because of race, color, religion, sex (including pregnancy, gender identity, and sexual orientation), national origin, age, veteran or military status, disability, genetic information, or any other basis prohibited by applicable law. When required by law, we might record certain information or applicants for employment may be invited to voluntarily disclose protected characteristics.