Managing Director - OT Security

Job Posting End Date
11-11-2026
Please note the job posting will close on the day before the posting end date.
Job Summary
The Managing Director, OT Security provides senior leadership for the cybersecurity strategy, operating model, services, and risk outcomes protecting operational technology across AEP's Transmission, Distribution, and Generation fleet, including nuclear generation in coordination with the licensed nuclear cybersecurity program. The role leads a shared-services OT Security organization and aligns priorities, investment, talent, and delivery with business-unit operational needs, enterprise cybersecurity strategy, NERC CIP, NRC, and internal cybersecurity requirements, and the safety, reliability, and resilience expectations of critical infrastructure.
This leader must bring deep, practical understanding of the business of electricity generation, transmission, distribution, and how electricity systems are protected from cyber threats. The Managing Director is accountable for ensuring OT Security group can define security requirements, lead architecture and engineering efforts, validate security outcomes, prioritize vulnerability risk, integrate monitoring and detection, coordinate OT incident response and recovery, assess technology, maintain trusted Business Unit partnerships, and build missing OT security capabilities. The role operates through established enterprise authorities and leverages Enterprise Security capabilities rather than duplicating them.
Please note: This position is 100% onsite in either Columbus, OH or Austin, TX
Job Description
What you’ll do:
Leadership Accountabilities
Set and communicate the OT Security vision, strategy, priorities, service model, and multi-year direction across the in-scope operational technology environment.
Provide executive leadership for the OT Security portfolio and its persistent services, ensuring clear ownership, quality, prioritization, integration, performance, and measurable risk reduction.
Align OT cybersecurity priorities and investment with Transmission, Distribution, Generation, and Nuclear leaders, Enterprise Security, enterprise risk and governance functions, operational reliability requirements, and regulatory obligations.
Establish clear accountability, delegated decision authority, engagement boundaries, escalation paths, and operating expectations across OT Security, Business Units, Enterprise Security, projects, vendors, and other service owners.
Guide portfolio demand, capacity, organizational design, talent strategy, and sourcing based on risk, service health, planned outages, incidents, delivery performance, emerging threats, and business demand.
Ensure material OT cyber risk, unresolved control gaps, readiness concerns, dependencies, and ownership conflicts are transparent to senior leadership and escalated through authorized governance paths.
Maintain the technical depth and credibility to challenge high-consequence engineering and security conclusions, and sponsor consistent technical-review, validation, and quality practices.
Build durable executive partnerships with Business Unit and Enterprise Security leaders so OT security work aligns to operating cadence, work authorization, safety, change management, maintenance, and incident processes.
Develop leaders and a multidisciplinary OT cybersecurity team with succession depth, cross-training, delegated authority, strong technical judgment, and clear primary and secondary coverage.
Represent OT cybersecurity in senior governance forums and serve as a senior advisor to executive leadership and the Board on operational cyber risk, capability gaps, technology choices, resilience, and security investment.
Operational Technology Domain Expertise
The Managing Director must bring deep, practical understanding of how the electric system is operated and protected, from generation through transmission and distribution to the customer, including one or more of the functional areas below:
Transmission: EMS/SCADA, control centers, substations and substation automation, protective relaying, ICCP and inter-utility communications, and Reliability Coordinator/RTO interdependencies.
Distribution: ADMS/DMS/OMS, distribution automation, AMI, DER integration, field area networks, and grid-edge devices.
Generation: Plant DCS, PLCs, safety instrumented systems, turbine, boiler, and emissions controls across fossil, gas, hydro, and renewable facilities.
Additional experience in the following area(s) considered a plus:
Nuclear: Nuclear plant digital instrumentation and control, 10 CFR 73.54, NEI 08-09, and Regulatory Guide 5.71; ability to partner effectively with nuclear leadership, operations, and the licensed cybersecurity program.
Standards: OT Specific protocols such as DNP3, IEC 61850, Modbus, ICCP/TASE.2, IEC 62443, and related ISA/IEC standards, along with OT-specific threats and adversaries known to target grid systems.
OT Security Portfolio and Services
The Managing Director provides portfolio leadership and operating accountability for the following persistent OT Security services across Transmission, Distribution, Generation, and Nuclear.
Security Requirements & Standards
Architecture & Design
Validation & Assurance
Vulnerability Management & Risk Prioritization
Monitoring & Detection Integration
Incident Response & Recovery
Security Partnership
Technology Assessment
OT Capability Development
Operating, Risk, and Partnership Responsibilities
Maintain enterprise-level visibility into OT Security commitments, priorities, dependencies, findings, and decisions, and ensure significant risks are visible to senior leadership.
Lead an intake and engagement model that empowers qualified specialists to act within delegated authority while keeping consequential commitments transparent and controlled.
Prioritize competing demand across Business Units, projects, outages, incidents, vulnerability work, and capability development, preventing unsupported scope expansion or unintended transfer of operational ownership.
Ensure work closes with a clear outcome: validated completion, tracked remediation, accepted risk, authorized deferral, or documented escalation.
Ensure enterprise cybersecurity capabilities are adapted to OT requirements where technically feasible and independently validated before operational use; determine the appropriate enduring owner for new capabilities.
Govern planned after-hours support, incident escalation, site stabilization guidance, and any approved on-call model while preserving Business Unit authority for operational decisions and work authorization.
Intervene in high-consequence, novel, disputed, or cross-functional matters and support withholding security endorsement when material requirements are unmet and no supportable disposition exists.
Lead OT supply chain and vendor security risk management with OEMs, integrators, and service providers, including NERC CIP-013 and emerging federal Bulk Power System supply chain requirements.
Drive secure remote access, OT identity and access management, network segmentation, and internal network security monitoring, including NERC CIP-015.
Ensure OT backup, recovery, and restoration capabilities support operating in degraded conditions and timely return to service.
Integrate cyber and physical security for substations, control centers, and generating stations, including nuclear facilities.
Ensure new grid technologies (DER, AMI, distribution automation, AI in OT, and OT digital twin capabilities) are secured by design.
Represent AEP with E-ISAC, DOE, CISA, NRC, NERC, and industry peers, and participate in GridEx and sector exercises.
Establish OT security metrics and deliver clear, executive-ready risk reporting to senior leadership and the Board.
Expected Results
A clear, enterprise-aligned OT Security strategy, service portfolio, operating model, and multi-year capability roadmap.
Material OT cyber risk is reduced or formally dispositioned, controls and services are validated, and incident and recovery readiness improves.
Transmission, Distribution, Generation, and Nuclear leaders have trusted OT Security partners, predictable engagement, clear responsibilities, and effective escalation.
NERC CIP and NRC cybersecurity obligations are met, and OT recovery and restoration readiness is demonstrated through exercises.
Demand, priorities, investment needs, scope, dependencies, and blockers are visible; work reaches formal disposition and leadership decisions are supported by credible evidence.
Enterprise Security reachback is effective, unnecessary duplication is minimized, enterprise capabilities work appropriately in OT, and ownership transitions succeed.
Capability depth, leadership bench strength, cross-training, and succession improve while single points of failure decline.
Measurable improvement in the maturity, reliability, scalability, and sustainability of persistent OT Security services.
Experience and Leadership Capabilities
Progressive leadership experience