Director, Technology (Threat Exposure & Assurance Management)

American Electric Power•Columbus, OH

22h•$188,524 - $245,080•Onsite

About The Position

The Director of Threat Exposure & Assurance Management is a senior technology leader within centralized IT who has built, delivered, or operated enterprise services. The role calls for broad knowledge of infrastructure, networks, applications, platforms, and cloud; technical depth in at least one domain; and strong security, vulnerability, and risk-analysis expertise. Serving as the dedicated liaison for the Chief Information & Technology Officer (CITO) organization, the Director operates a hub-and-spoke model in which a central hub coordinates priorities, governance, and assurance while technology owners execute remediation. Enterprise Cybersecurity owns policy, standards, and threat intelligence. This role owns the speed and consistency of CITO execution and measurable risk reduction. The Director translates findings into practical engineering and operational work, balancing exploitability, exposure, and business impact with testing, change discipline, service dependencies, and availability. The role aligns execution with AEP risk tolerance and regulatory obligations while maturing people, processes, and automation. The Director defines and executes enterprise remediation strategy; owns the end-to-end remediation lifecycle; prioritizes and coordinates remediation across technology teams; leads the CITO response to emergency vulnerabilities and zero-day exposures; and maintains governance and reporting for remediation posture and residual risk. The role also drives technology lifecycle modernization, hardening, attack-surface reduction, automation, and continuous improvement, while building and leading a technically credible hub team and enabling the broader remediation-owner community.

Requirements

Bachelor’s degree in computer science, engineering, information security, business, or a related technical field, or an equivalent combination of education and related experience.
At least 10 years of relevant work experience, including 6 years in a leadership role.
Substantive enterprise IT engineering, operations, or technology delivery responsibilities and demonstrated leadership of cross-team technology execution.
Proven experience delivering and operating enterprise technology services, implementing production changes, coordinating engineering and operations teams, and managing service dependencies and operational trade-offs.
Candidates whose experience is primarily security policy, audit, or advisory work must also demonstrate the required technology delivery and operational background.
Broad working knowledge of enterprise infrastructure, networking, applications, platforms, and cloud, including how these domains support business services.
Substantive hands-on engineering, operations, or delivery experience and technical depth in at least one domain, with the ability to evaluate remediation plans across domains.
Strong knowledge of security principles, vulnerability management, threat exposure, risk analysis, and remediation practices.
Ability to interpret security findings and threat intelligence, assess exploitation potential and business impact, evaluate compensating controls, and translate risk into practical technology decisions and measurable outcomes.
Demonstrated ability to influence without direct authority, align technology owners, resolve competing priorities, and sequence work across organizational boundaries.
Experience building and coaching teams, improving operating processes, and communicating technical risk and delivery trade-offs to executive, security, and technology stakeholders.

Nice To Haves

Experience translating regulatory and compliance obligations into technology operations across complex enterprise environments.
Experience integrating vulnerability tools with asset, service, and delivery processes, and using automation, analytics, and root-cause analysis to reduce recurring exposure.
Experience supporting technology modernization and a commitment to a secure, resilient, and sustainable energy future.

Responsibilities

Define and execute an enterprise technology remediation strategy across infrastructure, networks, applications, platforms, cloud, and shared services, aligned with Enterprise Cybersecurity policy, AEP risk tolerance, and regulatory obligations.
Own the end-to-end remediation lifecycle, including intake, technical triage, accountable-owner assignment, tracking, validation, and closure.
Establish remediation service levels by severity and asset criticality and hold delivery teams accountable for committed timelines.
Prioritize work using exploitability, active exploitation, exposure, service dependencies, asset criticality, and business impact rather than severity scores alone.
Translate findings into executable engineering and operational work with clear ownership and acceptance criteria.
Coordinate cross-team delivery with technology owners, engineering, and operations, ensuring plans address testing, change and release approvals, maintenance windows, patch deployment, rollback readiness, and service availability.
Integrate remediation into application and service lifecycle processes.
Lead the CITO response to emergency vulnerabilities and zero-day exposures in partnership with Enterprise Cybersecurity, coordinating impact assessment, containment, compensating controls, patching, validation, and timely executive reporting.
Serve as the single accountable security liaison between Enterprise Cybersecurity and the CITO organization, coordinating CITO execution and measurable risk reduction.
Operate the central hub translating security requirements, findings, and directives into prioritized work for technology spokes.
Build durable relationships with infrastructure, network, application, platform, cloud, and operations leaders to embed shared delivery accountability.
Resolve competing remediation priorities and negotiate resource allocation and sequencing with technology leaders.
Partner with architecture and engineering to evaluate trade-offs among security, scalability, reliability, availability, operational stability, and change risk.
Coordinate compensating controls and documented exceptions or risk-acceptance requests when immediate remediation is not feasible, routing decisions through established governance to authorized approvers.
Maintain disciplined governance for intake, escalation, exceptions, and change execution.
Report remediation posture, progress, and residual risk with clear ownership and business context.
Govern vendor and partner commitments to ensure verifiable outcomes without operational fragility.
Drive patching and technology lifecycle modernization, configuration hardening, certificate and secrets management, identity and access improvements, and attack-surface reduction with accountable technology owners.
Eliminate systemic causes of recurring vulnerabilities through engineering standards, automation, and sustainable operating practices.
Apply Lean practices to reduce cycle time, manual effort, and handoff friction; use analytics and dashboards to expose bottlenecks, trends, and root causes.
Define, track, and report open vulnerabilities by severity, mean time to remediate, service-level attainment, backlog age, recurrence, and scan coverage, using these measures to improve execution and demonstrate risk reduction.
Build and lead a technically credible hub team through hiring, coaching, performance management, talent development, and succession planning.
Foster an inclusive culture of collaboration, accountability, and continuous learning.
Enable the extended community of remediation owners with practical playbooks, escalation paths, and shared delivery expectations so risk reduction becomes part of normal technology operations.