Security Specialist Principal

American Electric Power • Columbus, OH

3d • $98,993 - $128,688

About The Position

AEP is seeking a highly motivated Detection Engineer to join its Cybersecurity Intelligence and Defense team. The role designs, develops, and optimizes advanced detections across endpoint, network, cloud, identity, and application environments. It applies threat intelligence, threat-hunting findings, adversary behaviors, and enterprise telemetry to create high-fidelity detections that improve visibility, accelerate threat identification, and strengthen AEP’s cybersecurity posture. The Detection Engineer partners with Security Operations, Threat Hunting, Incident Response, and Intelligence teams to improve detection coverage, validate effectiveness, and reduce the time needed to detect and respond to cyber threats.

The role also supports cyber deception initiatives by integrating deception telemetry, validating attack-path visibility, and using insights from deceptive technologies to improve detection fidelity and provide early warning of adversary activity. The ideal candidate has a deep understanding of adversary tactics, techniques, and procedures (TTPs), security monitoring technologies, and data analytics, and applies this expertise to improve coverage, reduce false positives, increase operational effectiveness, and strengthen cyber resilience.

Requirements

• Bachelor’s degree, or associate degree with 2 years of relevant system administration, help desk, or security experience (cyber or physical); or high school diploma/GED with 4 years of relevant IT system administration, help desk, or security experience (cyber or physical); or graduation from an approved Cybersecurity Program; alternatively, non-degree qualifications such as demonstrated hands-on ability in a technical interview or assessment.
• 4 or more years of Information Technology related experience; OR 2 or more years of security related experience. Military or government work experience may count toward the security-related experience requirement in addition to experience identified above.
• Current government security clearance or ability to obtain a security clearance at a minimum of the Secret level.

Nice To Haves

• Licenses and certifications: CSFA, GCCC, GCDA, GCED, GCFA, GCFE, GCIA, GCIH, GCIP, GCTI, GDAT, GICSP, GMON, GOSI, GREM, GRID, GSOM, GXPN, OSCP, OSEE, Treadstone Certified Threat Intelligence Analyst/Certified Threat Counterintelligence Analyst, CERT Incident Response Process Professional, CREST Certified Host Intrusion Analyst, CREST Certified Incident Manager, CREST Certified Malware Reverse Engineer, CREST Certified Network Intrusion Analyst, or CREST Certified Threat Intelligence Manager.
• Demonstrable experience in one or more of these disciplines: Detection Engineer, Incident Response Analyst, CIRC/SOC Lead, Threat Intelligence or Counterintelligence Analyst, Cyber Threat Hunt Analyst, or Malware Reverse Engineer.

Responsibilities

• Design, develop, test, validate, and deploy high-fidelity security detections across SIEM, EDR, NDR, cloud, identity, and other security monitoring platforms.
• Improve the detection engineering program through telemetry enrichment, detection validation, purple team exercises, and measurement of detection effectiveness and operational outcomes.
• Translate threat intelligence, threat-hunting findings, incident response lessons learned, and emerging adversary tradecraft into detection content and monitoring strategies.
• Develop and maintain detection rules, correlation searches, behavioral analytics, anomaly detections, and automated alerting mechanisms.
• Tune and optimize detections to improve fidelity, reduce false positives and alert fatigue, and increase analyst efficiency.
• Map detections to the MITRE ATT&CK framework, assess coverage, and identify opportunities to improve visibility across the attack lifecycle.
• Collaborate with Threat Hunting, Incident Response, Security Operations, and Intelligence teams to validate detections and strengthen detection and response capabilities.
• Research, develop, and operationalize detection use cases for emerging threats, novel attack techniques, and evolving adversary behaviors.
• Analyze and use security telemetry from endpoints, networks, cloud environments, identity providers, applications, and other enterprise sources to develop detections and improve visibility.
• Measure and report detection performance, effectiveness, and coverage.
• Support purple team exercises, tabletop exercises, and adversary emulation activities.
• Develop, maintain, and enhance detection engineering standards, documentation, use case libraries, and engineering processes.
• Automate detection engineering workflows, content deployment, testing, validation, and quality assurance processes.
• Identify telemetry gaps and partner with technology owners to onboard, normalize, enrich, and operationalize new data sources.
• Design, deploy, and maintain deception technologies, including decoys, honeypots, and deceptive credentials, to detect and disrupt adversary activity.
• Analyze deception events and attacker interactions to identify adversary behaviors, support investigations, and improve detection and response capabilities.

Benefits

• Base salary
• Annual bonus
• Long-term incentive
• 401(k) match
• AEP Pension
• Comprehensive benefits package designed to support and enhance employees’ overall well-being

What This Job Offers

• Job Type: Full-time
• Career Level: Senior