Managing Director - OT Security

American Electric Power•Columbus, OH

3d•Onsite

About The Position

The Managing Director, OT Security provides senior leadership for the cybersecurity strategy, operating model, services, and risk outcomes protecting AEP's operational technology across Transmission, Distribution, and Generation, including nuclear generation in coordination with the licensed nuclear cybersecurity program. The role leads a shared-services OT Security organization and aligns priorities, investment, talent, and delivery with business-unit needs, enterprise cybersecurity strategy, NERC CIP, NRC, internal cybersecurity requirements, and critical-infrastructure safety, reliability, and resilience expectations. This leader needs deep practical understanding of electricity generation, transmission, distribution, and the protection of electric systems from cyber threats. The Managing Director is accountable for the OT Security group's ability to define security requirements; lead architecture and engineering; validate security outcomes; prioritize vulnerability risk; integrate monitoring and detection; coordinate incident response and recovery; assess technology; maintain trusted Business Unit partnerships; and develop missing OT security capabilities. The role operates through established enterprise authorities and leverages Enterprise Security capabilities rather than duplicating them. This is a 100% onsite position in either Columbus, Ohio, or Austin, Texas. The role sets the OT Security vision, strategy, service model, priorities, and multi-year direction; provides executive portfolio leadership; aligns investments and work with business and regulatory needs; establishes accountabilities and escalation paths; and maintains visibility of material risks and control gaps. It builds executive partnerships and a multidisciplinary team, represents OT cybersecurity in governance forums, and advises executive leadership and the Board on operational cyber risk, capabilities, resilience, technology, and investment. The role provides portfolio leadership and operating accountability for persistent OT Security services including security requirements and standards, architecture and design, validation and assurance, vulnerability management and risk prioritization, monitoring and detection integration, incident response and recovery, security partnership, technology assessment, and OT capability development. Responsibilities also include OT supply-chain security, secure remote access, identity and access management, network segmentation, backup and restoration readiness, integration of cyber and physical security, and security-by-design for emerging grid technologies. The Managing Director represents AEP with government, regulatory, and industry organizations and establishes executive-ready OT security metrics and reporting. Success includes an enterprise-aligned OT Security strategy and operating model; reduced or formally dispositioned material cyber risk; validated controls and improved incident and recovery readiness; effective partnerships and clear responsibilities across Transmission, Distribution, Generation, and Nuclear; compliance with NERC CIP and NRC cybersecurity obligations; visible priorities and documented outcomes; effective use of Enterprise Security capabilities; and stronger OT security capability, leadership depth, and sustainable services.

Requirements

Bachelor's degree in engineering, computer science, or a related field; equivalent combinations of education, military service, and operational experience will be considered.
15+ years of progressive experience in cybersecurity, operational technology, engineering, or operations.
7+ years of experience in senior leadership.
Direct experience securing electric utility operational environments across multiple areas of transmission, distribution, and generation.
Demonstrated expertise in NERC CIP compliance and OT security architecture, monitoring, vulnerability management, and incident response.
Progressive leadership experience across cybersecurity, operational technology, engineering, critical infrastructure, technology operations, risk, or closely related disciplines.
Experience setting strategy and leading complex programs, portfolios, services, or multidisciplinary teams in a large, regulated, operationally sensitive, or critical-infrastructure environment.
Ability to balance cybersecurity outcomes with operational safety, reliability, availability, maintainability, regulatory obligations, and business priorities.
Ability to lead through influence across organizational boundaries, resolve accountability or ownership ambiguity, and communicate material risk to senior and executive leaders.
Experience establishing priorities, delegated authority, governance, service expectations, talent plans, and sustainable operating models across competing demand.
Hands-on OT and cybersecurity depth sufficient to evaluate technical quality, challenge engineering and security conclusions, and lead high-consequence decisions in live operating environments.
Experience building or maturing security capabilities and working with operational leaders, engineering teams, enterprise cybersecurity service owners, project organizations, governance functions, vendors, and executive stakeholders.

Nice To Haves

Nuclear power plant cybersecurity experience or direct work with NRC cybersecurity programs.
Engineering or operations background, such as protection and control, SCADA, or plant controls.
Certifications such as GICSP, GRID, GCIP, or CISSP.
Experience with nuclear plant digital instrumentation and control, 10 CFR 73.54, NEI 08-09, and Regulatory Guide 5.71.
Knowledge of OT-specific protocols and standards, including DNP3, IEC 61850, Modbus, ICCP/TASE.2, IEC 62443, and related ISA/IEC standards, as well as OT-specific threats and adversaries targeting grid systems.

Responsibilities

Set and communicate OT Security vision, strategy, priorities, service model, and multi-year direction across the in-scope operational technology environment.
Provide executive leadership for the OT Security portfolio and persistent services, ensuring clear ownership, quality, prioritization, integration, performance, and measurable risk reduction.
Align OT cybersecurity priorities and investment with Business Units, Enterprise Security, enterprise risk and governance functions, operational reliability requirements, and regulatory obligations.
Establish accountability, delegated decision authority, engagement boundaries, escalation paths, and operating expectations across OT Security, Business Units, Enterprise Security, projects, vendors, and other service owners.
Guide portfolio demand, capacity, organizational design, talent strategy, and sourcing in response to risk, service health, outages, incidents, delivery performance, threats, and business demand.
Make material OT cyber risks, control gaps, readiness concerns, dependencies, and ownership conflicts transparent to senior leadership and escalate them through authorized governance paths.
Sponsor consistent technical-review, validation, and quality practices, and challenge high-consequence engineering and security conclusions.
Build executive partnerships with Business Unit and Enterprise Security leaders so OT security work aligns with operating cadence, safety, work authorization, change management, maintenance, and incident processes.
Develop a multidisciplinary OT cybersecurity team with succession depth, cross-training, delegated authority, sound technical judgment, and primary and secondary coverage.
Represent OT cybersecurity in senior governance forums and advise executive leadership and the Board on operational cyber risk, capability gaps, technology choices, resilience, and security investment.
Maintain enterprise-level visibility into OT Security commitments, priorities, dependencies, findings, and decisions.
Lead an intake and engagement model that enables qualified specialists to act within delegated authority while keeping consequential commitments transparent and controlled.
Prioritize demand across Business Units, projects, outages, incidents, vulnerability work, and capability development, and prevent unsupported scope expansion or unintended transfer of operational ownership.
Ensure work closes with validated completion, tracked remediation, accepted risk, authorized deferral, or documented escalation.
Adapt enterprise cybersecurity capabilities to OT requirements where technically feasible, independently validate them before operational use, and determine enduring ownership for new capabilities.
Govern planned after-hours support, incident escalation, site stabilization guidance, and any approved on-call model while preserving Business Unit authority for operational decisions and work authorization.
Intervene in high-consequence, novel, disputed, or cross-functional matters and support withholding security endorsement when material requirements are unmet and no supportable disposition exists.
Lead OT supply-chain and vendor security risk management with OEMs, integrators, and service providers, including NERC CIP-013 and emerging federal Bulk Power System supply-chain requirements.
Drive secure remote access, OT identity and access management, network segmentation, and internal network security monitoring, including NERC CIP-015.
Ensure OT backup, recovery, and restoration capabilities support operation in degraded conditions and timely return to service.
Integrate cyber and physical security for substations, control centers, and generating stations, including nuclear facilities.
Ensure new grid technologies, including DER, AMI, distribution automation, AI in OT, and OT digital twins, are secured by design.
Represent AEP with E-ISAC, DOE, CISA, NRC, NERC, and industry peers, and participate in GridEx and sector exercises.
Establish OT security metrics and deliver executive-ready risk reporting to senior leadership and the Board.