Security Specialist Principal

American Electric Power•Columbus, OH

About The Position

AEP is seeking a highly motivated Detection Engineer to join its Cybersecurity Intelligence and Defense team. The role designs, develops, tests, validates, and optimizes advanced security detections across endpoint, network, cloud, identity, and application environments. It uses threat intelligence, threat hunting findings, adversary behaviors, and enterprise telemetry to improve visibility, identify threats sooner, reduce false positives, and strengthen the organization’s cybersecurity posture. The Detection Engineer works closely with Security Operations, Threat Hunting, Incident Response, and Intelligence teams to improve detection coverage, validate effectiveness, and reduce the time needed to detect and respond to threats. The role also supports cyber deception initiatives by deploying deception technologies, integrating their telemetry, validating attack-path visibility, and using attacker interactions to improve detection and provide early warning. The position requires a deep understanding of adversary tactics, techniques, and procedures, security monitoring technologies, and data analytics. Applicants must meet one of the listed education or equivalent qualification paths and satisfy the stated IT or security experience requirement. A current government security clearance, or the ability to obtain one at least at the Secret level, is required. The listed compensation range is $98,993 to $128,688, with additional compensation and benefits described in the posting.

Requirements

Bachelor’s degree; or associate degree plus 2 years of relevant system administration, help desk, or security experience (cyber or physical); or high school diploma/GED plus 4 years of relevant IT system administration, help desk, or security experience (cyber or physical); or graduation from an approved Cybersecurity Program; alternatively, non-degree qualifications such as hands-on demonstrated ability in a technical interview or assessment.
At least 4 years of information technology-related experience, or at least 2 years of security-related experience. Security experience may include military or government work experience in addition to experience identified above.
Current government security clearance or ability to obtain a security clearance at a minimum of the Secret level.

Nice To Haves

Demonstrable experience in one or more of these disciplines: Detection Engineer, Incident Response Analyst, CIRC/SOC Lead, Threat Intelligence or Counterintelligence Analyst, Cyber Threat Hunt Analyst, or Malware Reverse Engineer.
Relevant licenses or certifications, including CSFA, GCCC, GCDA, GCED, GCFA, GCFE, GCIA, GCIH, GCIP, GCTI, GDAT, GICSP, GMON, GOSI, GREM, GRID, GSOM, GXPN, OSCP, OSEE, Treadstone Certified Threat Intelligence Analyst/Certified Threat Counterintelligence Analyst, CERT Incident Response Process Professional, CREST Certified Host Intrusion Analyst, CREST Certified Incident Manager, CREST Certified Malware Reverse Engineer, CREST Certified Network Intrusion Analyst, or CREST Certified Threat Intelligence Manager.

Responsibilities

Design, develop, test, validate, and deploy high-fidelity security detections across SIEM, EDR, NDR, cloud, identity, and other monitoring platforms.
Improve the detection engineering program through telemetry enrichment, detection validation, purple team exercises, and measurement of detection effectiveness and operational outcomes.
Translate threat intelligence, threat hunting findings, incident response lessons, and emerging adversary tradecraft into detection content and monitoring strategies.
Develop and maintain detection rules, correlation searches, behavioral analytics, anomaly detections, and automated alerting mechanisms.
Tune detections to improve fidelity, reduce false positives and alert fatigue, and increase analyst efficiency.
Map detections to the MITRE ATT&CK framework, assess coverage, and identify visibility opportunities across the attack lifecycle.
Collaborate with Threat Hunting, Incident Response, Security Operations, and Intelligence teams to validate detections and strengthen detection and response capabilities.
Research, develop, and operationalize detection use cases for emerging threats, novel attack techniques, and evolving adversary behaviors.
Analyze security telemetry from endpoints, networks, cloud environments, identity providers, applications, and other enterprise data sources.
Measure and report detection performance, effectiveness, and coverage.
Support purple team exercises, tabletop exercises, and adversary emulation activities.
Develop and maintain detection engineering standards, documentation, use case libraries, and engineering processes.
Automate detection engineering workflows, content deployment, testing, validation, and quality assurance.
Identify telemetry gaps and partner with technology owners to onboard, normalize, enrich, and operationalize new data sources.
Design, deploy, and maintain deception technologies, including decoys, honeypots, and deceptive credentials.
Analyze deception events and attacker interactions to identify adversary behaviors, support investigations, and improve detection and response.