Managing Director - OT Security

American Electric Power•Columbus, OH

5d•$188,524 - $245,080•Onsite

About The Position

The Managing Director, OT Security provides senior leadership for cybersecurity strategy, operating model, services, and risk outcomes protecting AEP’s operational technology across its Transmission, Distribution, and Generation fleet, including nuclear generation in coordination with the licensed nuclear cybersecurity program. The role leads a shared-services OT Security organization and aligns priorities, investment, talent, and delivery with business-unit operational needs, enterprise cybersecurity strategy, NERC CIP, NRC, and internal requirements, as well as critical infrastructure safety, reliability, and resilience expectations. The position is accountable for ensuring the OT Security group can define security requirements; lead architecture and engineering; validate security outcomes; prioritize vulnerability risk; integrate monitoring and detection; coordinate OT incident response and recovery; assess technology; maintain trusted Business Unit partnerships; and develop missing OT security capabilities. It operates through established enterprise authorities and uses Enterprise Security capabilities rather than duplicating them. The role requires practical knowledge of electricity generation, transmission, distribution, and protection from cyber threats. It provides portfolio leadership and operating accountability for persistent OT Security services spanning security requirements and standards, architecture and design, validation and assurance, vulnerability management and risk prioritization, monitoring and detection integration, incident response and recovery, security partnership, technology assessment, and capability development. The position is 100% onsite in either Columbus, Ohio, or Austin, Texas. The listed compensation range is $188,524–$245,080. The position’s physical demand level is sedentary, involving mostly sitting, with occasional walking or standing and exertion of up to 10 pounds occasionally.

Requirements

Bachelor’s degree in engineering, computer science, or a related field; equivalent combinations of education, military service, and operational experience will be considered.
15 or more years of progressive experience in cybersecurity, operational technology, engineering, or operations, including 7 or more years in senior leadership.
Direct experience securing electric utility operational environments across multiple areas of transmission, distribution, and generation.
Demonstrated expertise in NERC CIP compliance and OT security architecture, monitoring, vulnerability management, and incident response.
Progressive leadership experience across cybersecurity, operational technology, engineering, critical infrastructure, technology operations, risk, or closely related disciplines.
Experience setting strategy and leading complex programs, portfolios, services, or multidisciplinary teams in a large, regulated, operationally sensitive, or critical-infrastructure environment.
Demonstrated ability to balance cybersecurity outcomes with operational safety, reliability, availability, maintainability, regulatory obligations, and business priorities.
Ability to lead through influence across organizational boundaries, resolve accountability or ownership ambiguity, and communicate material risk to senior and executive leaders.
Experience establishing priorities, delegated authority, governance, service expectations, talent plans, and sustainable operating models across competing demand.
Hands-on OT and cybersecurity depth sufficient to evaluate technical quality, challenge engineering and security conclusions, and lead high-consequence decisions in live operating environments.
Experience building or maturing security capabilities and working with operational leaders, engineering teams, enterprise cybersecurity service owners, project organizations, governance functions, vendors, and executive stakeholders.

Nice To Haves

Strongly preferred: nuclear power plant cybersecurity experience or direct work with NRC cybersecurity programs.
Preferred: engineering or operations background, such as protection and control, SCADA, or plant controls.
Preferred certifications include GICSP, GRID, GCIP, or CISSP.
Experience in transmission environments involving EMS/SCADA, control centers, substations and substation automation, protective relaying, ICCP and inter-utility communications, or Reliability Coordinator/RTO interdependencies.
Experience in distribution environments involving ADMS/DMS/OMS, distribution automation, AMI, DER integration, field area networks, or grid-edge devices.
Experience in generation environments involving plant DCS, PLCs, safety instrumented systems, turbine, boiler, or emissions controls across fossil, gas, hydro, or renewable facilities.
Nuclear experience involving plant digital instrumentation and control, 10 CFR 73.54, NEI 08-09, or Regulatory Guide 5.71.
Familiarity with OT-specific protocols and standards such as DNP3, IEC 61850, Modbus, ICCP/TASE.2, IEC 62443, and related ISA/IEC standards, and with OT-specific threats and adversaries targeting grid systems.

Responsibilities

Set and communicate the OT Security vision, strategy, priorities, service model, and multi-year direction across the in-scope operational technology environment.
Provide executive leadership for the OT Security portfolio and persistent services, ensuring clear ownership, quality, prioritization, integration, performance, and measurable risk reduction.
Align OT cybersecurity priorities and investment with Transmission, Distribution, Generation, and Nuclear leaders, Enterprise Security, enterprise risk and governance functions, operational reliability requirements, and regulatory obligations.
Establish accountability, delegated decision authority, engagement boundaries, escalation paths, and operating expectations across OT Security, Business Units, Enterprise Security, projects, vendors, and other service owners.
Guide portfolio demand, capacity, organizational design, talent strategy, and sourcing based on risk, service health, planned outages, incidents, delivery performance, emerging threats, and business demand.
Ensure material OT cyber risk, unresolved control gaps, readiness concerns, dependencies, and ownership conflicts are transparent to senior leadership and escalated through authorized governance paths.
Sponsor consistent technical-review, validation, and quality practices, and challenge high-consequence engineering and security conclusions.
Build executive partnerships with Business Unit and Enterprise Security leaders so OT security work aligns with operating cadence, work authorization, safety, change management, maintenance, and incident processes.
Develop leaders and a multidisciplinary OT cybersecurity team with succession depth, cross-training, delegated authority, strong technical judgment, and clear primary and secondary coverage.
Represent OT cybersecurity in senior governance forums and advise executive leadership and the Board on operational cyber risk, capability gaps, technology choices, resilience, and security investment.
Maintain enterprise-level visibility into OT Security commitments, priorities, dependencies, findings, and decisions, and ensure significant risks are visible to senior leadership.
Lead an intake and engagement model that empowers qualified specialists to act within delegated authority while keeping consequential commitments transparent and controlled.
Prioritize demand across Business Units, projects, outages, incidents, vulnerability work, and capability development, preventing unsupported scope expansion or unintended transfer of operational ownership.
Ensure work closes with validated completion, tracked remediation, accepted risk, authorized deferral, or documented escalation.
Ensure enterprise cybersecurity capabilities are adapted to OT requirements where technically feasible and independently validated before operational use; determine enduring ownership for new capabilities.
Govern planned after-hours support, incident escalation, site stabilization guidance, and any approved on-call model while preserving Business Unit authority for operational decisions and work authorization.
Intervene in high-consequence, novel, disputed, or cross-functional matters and support withholding security endorsement when material requirements are unmet and no supportable disposition exists.
Lead OT supply chain and vendor security risk management with OEMs, integrators, and service providers, including NERC CIP-013 and emerging federal Bulk Power System supply chain requirements.
Drive secure remote access, OT identity and access management, network segmentation, and internal network security monitoring, including NERC CIP-015.
Ensure OT backup, recovery, and restoration capabilities support operation in degraded conditions and timely return to service.
Integrate cyber and physical security for substations, control centers, and generating stations, including nuclear facilities.
Ensure new grid technologies, including DER, AMI, distribution automation, AI in OT, and OT digital twin capabilities, are secured by design.
Represent AEP with E-ISAC, DOE, CISA, NRC, NERC, and industry peers, and participate in GridEx and sector exercises.
Establish OT security metrics and provide executive-ready risk reporting to senior leadership and the Board.
Lead the OT Security service portfolio across security requirements and standards, architecture and design, validation and assurance, vulnerability management and risk prioritization, monitoring and detection integration, incident response and recovery, security partnership, technology assessment, and OT capability development.