Managing Director - OT Security

• Set and communicate the OT Security vision, strategy, priorities, service model, and multi-year direction across the in-scope operational technology environment.
• Provide executive leadership for the OT Security portfolio and its persistent services, ensuring clear ownership, quality, prioritization, integration, performance, and measurable risk reduction.
• Align OT cybersecurity priorities and investment with Transmission, Distribution, Generation, and Nuclear leaders, Enterprise Security, enterprise risk and governance functions, operational reliability requirements, and regulatory obligations.
• Establish clear accountability, delegated decision authority, engagement boundaries, escalation paths, and operating expectations across OT Security, Business Units, Enterprise Security, projects, vendors, and other service owners.
• Guide portfolio demand, capacity, organizational design, talent strategy, and sourcing based on risk, service health, planned outages, incidents, delivery performance, emerging threats, and business demand.
• Ensure material OT cyber risk, unresolved control gaps, readiness concerns, dependencies, and ownership conflicts are transparent to senior leadership and escalated through authorized governance paths.
• Maintain the technical depth and credibility to challenge high-consequence engineering and security conclusions, and sponsor consistent technical-review, validation, and quality practices.
• Build durable executive partnerships with Business Unit and Enterprise Security leaders so OT security work aligns to operating cadence, work authorization, safety, change management, maintenance, and incident processes.
• Develop leaders and a multidisciplinary OT cybersecurity team with succession depth, cross-training, delegated authority, strong technical judgment, and clear primary and secondary coverage.
• Represent OT cybersecurity in senior governance forums and serve as a senior advisor to executive leadership and the Board on operational cyber risk, capability gaps, technology choices, resilience, and security investment.

Operational Technology Domain Expertise

The Managing Director must bring deep, practical understanding of how the electric system is operated and protected, from generation through transmission and distribution to the customer, including one or more of the functional areas below: •

OT Specific protocols such as DNP3, IEC 61850, Modbus, ICCP/TASE.2, IEC 62443, and related ISA/IEC standards, along with OT-specific threats and adversaries known to target grid systems.

OT Security Portfolio and Services

The Managing Director provides portfolio leadership and operating accountability for the following persistent OT Security services across Transmission, Distribution, Generation, and Nuclear.

• Security Requirements & Standards
• Architecture & Design
• Validation & Assurance
• Vulnerability Management & Risk Prioritization
• Monitoring & Detection Integration
• Incident Response & Recovery
• Security Partnership
• Technology Assessment
• OT Capability Development

Operating, Risk, and Partnership Responsibilities

• Maintain enterprise-level visibility into OT Security commitments, priorities, dependencies, findings, and decisions, and ensure significant risks are visible to senior leadership.
• Lead an intake and engagement model that empowers qualified specialists to act within delegated authority while keeping consequential commitments transparent and controlled.
• Prioritize competing demand across Business Units, projects, outages, incidents, vulnerability work, and capability development, preventing unsupported scope expansion or unintended transfer of operational ownership.
• Ensure work closes with a clear outcome: validated completion, tracked remediation, accepted risk, authorized deferral, or documented escalation.
• Ensure enterprise cybersecurity capabilities are adapted to OT requirements where technically feasible and independently validated before operational use; determine the appropriate enduring owner for new capabilities.
• Govern planned after-hours support, incident escalation, site stabilization guidance, and any approved on-call model while preserving Business Unit authority for operational decisions and work authorization.
• Intervene in high-consequence, novel, disputed, or cross-functional matters and support withholding security endorsement when material requirements are unmet and no supportable disposition exists.
• Lead OT supply chain and vendor security risk management with OEMs, integrators, and service providers, including NERC CIP-013 and emerging federal Bulk Power System supply chain requirements.
• Drive secure remote access, OT identity and access management, network segmentation, and internal network security monitoring, including NERC CIP-015.
• Ensure OT backup, recovery, and restoration capabilities support operating in degraded conditions and timely return to service.
• Integrate cyber and physical security for substations, control centers, and generating stations, including nuclear facilities.
• Ensure new grid technologies (DER, AMI, distribution automation, AI in OT, and OT digital twin capabilities) are secured by design.
• Represent AEP with E-ISAC, DOE, CISA, NRC, NERC, and industry peers, and participate in GridEx and sector exercises.
• Establish OT security metrics and deliver clear, executive-ready risk reporting to senior leadership and the Board.

Expected Results

• A clear, enterprise-aligned OT Security strategy, service portfolio, operating model, and multi-year capability roadmap.
• Material OT cyber risk is reduced or formally dispositioned, controls and services are validated, and incident and recovery readiness improves.
• Transmission, Distribution, Generation, and Nuclear leaders have trusted OT Security partners, predictable engagement, clear responsibilities, and effective escalation.
• NERC CIP and NRC cybersecurity obligations are met, and OT recovery and restoration readiness is demonstrated through exercises.
• Demand, priorities, investment needs, scope, dependencies, and blockers are visible; work reaches formal disposition and leadership decisions are supported by credible evidence.
• Enterprise Security reachback is effective, unnecessary duplication is minimized, enterprise capabilities work appropriately in OT, and ownership transitions succeed.
• Capability depth, leadership bench strength, cross-training, and succession improve while single points of failure decline.
• Measurable improvement in the maturity, reliability, scalability, and sustainability of persistent OT Security services.

Experience and Leadership Capabilities

• Progressive leadership experience across cybersecurity, operational technology, engineering, critical infrastructure, technology operations, risk, or closely related disciplines.
• Experience setting strategy and leading complex programs, portfolios, services, or multidisciplinary teams in a large, regulated, operationally sensitive, or critical-infrastructure environment.
• Demonstrated ability to balance cybersecurity outcomes with operational safety, reliability, availability, maintainability, regulatory obligations, and business priorities.
• Ability to lead through influence across organizational boundaries, resolve accountability or ownership ambiguity, and communicate material risk to senior and executive leaders.
• Experience establishing priorities, delegated authority, governance, service expectations, talent plans, and sustainable operating models across competing demand.
• Hands-on OT and cybersecurity depth sufficient to evaluate technical quality, challenge engineering and security conclusions, and lead high-consequence decisions in live operating environments.
• Experience building or maturing security capabilities and working with operational leaders, engineering teams, enterprise cybersecurity service owners, project organizations, governance functions, vendors, and executive stakeholders.

What we're looking for:

• Bachelor's degree in engineering, computer science, or a related field; equivalent combinations of education, military service, and operational experience will be considered.
• 15+ years of progressive experience in cybersecurity, operational technology, engineering, or operations, including 7+ years in senior leadership.

•

demonstrated expertise in NERC CIP compliance and OT security architecture, monitoring, vulnerability management, and incident response.

• S

engineering or operations background (e.g., protection and control, SCADA, plant controls) and certifications such as GICSP, GRID, GCIP, or CISSP.

Leadership Decisions Affecting Final Requisition

• Final reporting relationship, corporate job code, salary grade, location, travel percentage, and approved HR qualification language.
• Final organization structure and number/level of direct reports, including whether service-delivery or deputy leadership is part of the model.
• Approved after-hours and on-call model and associated HR requirements.
• Nuclear accountability model (direct accountability or oversight and integration) defined with Nuclear leadership, consistent with NRC license obligations.

Why This Role Matters

Operational technology is foundational to the safe and reliable delivery of electric service. The Managing Director, OT Security ensures AEP has senior, accountable, and technically credible leadership for the cyber risk, services, partnerships, and capabilities that protect our transmission, distribution, and generation fleet, including nuclear, while preserving the operating authority of the Business Units and leveraging enterprise cybersecurity capabilities.

American Electric Power (On-Site) #LI-Onsite #AEPCareers

At AEP, we're more than just an energy company - we're a team of dedicated professionals committed to delivering safe, reliable, and innovative energy solutions. Guided by our mission to put the customer first, we strive to exceed expectations by listening, responding, and continuously improving the way we serve our communities. If you're passionate about making a meaningful impact and being part of a forward-thinking organization, this is the company for you!