Cybersecurity Mgr - Advanced Threat Mitigation Team

aep; Columbus (OH); On-site; USD 120,000 - 180,000; Full time

Job summary

AEP is seeking a Cybersecurity Manager - Advanced Threat Mitigation to lead the ATM team within the Intelligence & Defense organization. You will oversee analysts, incident responders, detection engineers, and threat hunters responsible for monitoring, detecting, and mitigating threats across IT, OT, cloud, and business environments.

You will drive strategic leadership for threat detection, incident response coordination, threat hunting, and defense automation, partnering with Cybersecurity

Responsibilities

• Lead and develop a team of cybersecurity professionals responsible for threat monitoring, incident response, threat hunting, detection engineering, and cyber defense operations.
• Provide coaching, mentoring, performance management, and professional development opportunities for team members.
• Foster a culture of operational excellence, accountability, continuous learning, innovation, and threat-informed defense.
• Ensure adequate staffing, training, operational readiness, and succession planning to support continuous cyber defense operations.
• Establish performance metrics, key risk indicators, and operational objectives that drive measurable improvements in cybersecurity effectiveness.
• Promote collaboration across cybersecurity functions including intelligence, engineering, architecture, vulnerability management, identity security, and incident response teams.
• Direct daily cyber threat monitoring operations, ensuring timely detection, analysis, escalation, and response to cybersecurity events.
• Oversee the identification and investigation of potential security incidents affecting enterprise, cloud, operational technology, and third-party environments.
• Ensure effective utilization of SIEM, EDR/XDR, NDR, cloud security, identity monitoring, and threat intelligence platforms to identify malicious activity and emerging threats.
• Establish operational procedures that promote rapid triage, accurate threat identification, effective prioritization, and timely escalation.
• Drive continuous improvement of security monitoring coverage, alert fidelity, detection effectiveness, and operational efficiency.
• Ensure meaningful operational metrics and reporting are provided to leadership regarding threat activity, investigations, incidents, and response effectiveness.
• Lead the strategic direction and maturity of AEP's detection engineering program.
• Oversee the design, development, testing, deployment, and lifecycle management of security detections across SIEM, EDR/XDR, NDR, cloud, identity, and OT security platforms.
• Ensure threat intelligence, threat hunting findings, incident investigations, and emerging threat research are translated into actionable detection content.
• Direct the creation and maintenance of detection rules, correlation searches, behavioral analytics, alerting mechanisms, and monitoring use cases.
• Establish processes to measure and validate detection effectiveness, ATT&CK framework coverage, and monitoring performance across the enterprise.
• Lead efforts to improve detection fidelity, reduce false positives, minimize alert fatigue, and optimize analyst effectiveness.
• Direct adversary emulation, purple team, detection validation, and continuous assessment activities to improve defensive effectiveness.
• Drive automation and advanced analytics initiatives that improve monitoring scalability, operational efficiency, and response speed.
• Serve as the primary leadership escalation point for

Job description

Job Summary

The Cybersecurity Manager - Advanced Threat Mitigation leads AEP's Advanced Threat Mitigation (ATM) team within the Intelligence & Defense organization. This team is responsible for enterprise cyber threat monitoring, detection engineering, incident response, threat hunting, and advanced cyber defense operations. The manager oversees a team of cybersecurity analysts, incident responders, detection engineers, and threat hunting professionals responsible for identifying, analyzing, containing, and mitigating cyber threats targeting AEP's information technology (IT), operational technology (OT), cloud, and business environments.

The Advanced Threat Mitigation team serves as AEP's frontline cyber defense capability, leveraging security monitoring platforms, threat intelligence, advanced analytics, automation, and incident response processes to rapidly detect and respond to malicious activity. The Cybersecurity Manager is responsible for ensuring effective cyber threat detection, incident response coordination, threat hunting operations, and continuous enhancement of AEP's defensive capabilities against evolving cyber threats.

This role provides strategic leadership for the development of advanced cyber defense capabilities, integrating threat intelligence, detection engineering, response automation, and operational analytics to reduce cyber risk and improve AEP's security posture. The position works closely with Cybersecurity Operations, Threat Intelligence, Vulnerability Management, Architecture, Digital Technology Services, OT Security, and business partners to safeguard critical systems and support AEP's mission of delivering safe, reliable energy.

Job Description

What you'll do:

Leadership & Team Management

• Lead and develop a team of cybersecurity professionals responsible for threat monitoring, incident response, threat hunting, detection engineering, and cyber defense operations.
• Provide coaching, mentoring, performance management, and professional development opportunities for team members.
• Foster a culture of operational excellence, accountability, continuous learning, innovation, and threat-informed defense.
• Ensure adequate staffing, training, operational readiness, and succession planning to support continuous cyber defense operations.
• Establish performance metrics, key risk indicators, and operational objectives that drive measurable improvements in cybersecurity effectiveness.
• Promote collaboration across cybersecurity functions including intelligence, engineering, architecture, vulnerability management, identity security, and incident response teams.

Threat Monitoring & Detection Operations

• Direct daily cyber threat monitoring operations, ensuring timely detection, analysis, escalation, and response to cybersecurity events.
• Oversee the identification and investigation of potential security incidents affecting enterprise, cloud, operational technology, and third-party environments.
• Ensure effective utilization of SIEM, EDR/XDR, NDR, cloud security, identity monitoring, and threat intelligence platforms to identify malicious activity and emerging threats.
• Establish operational procedures that promote rapid triage, accurate threat identification, effective prioritization, and timely escalation.
• Drive continuous improvement of security monitoring coverage, alert fidelity, detection effectiveness, and operational efficiency.
• Ensure meaningful operational metrics and reporting are provided to leadership regarding threat activity, investigations, incidents, and response effectiveness.

Threat Detection Engineering & Security Analytics

• Lead the strategic direction and maturity of AEP's detection engineering program.
• Oversee the design, development, testing, deployment, and lifecycle management of security detections across SIEM, EDR/XDR, NDR, cloud, identity, and OT security platforms.
• Ensure threat intelligence, threat hunting findings, incident investigations, and emerging threat research are translated into actionable detection content.
• Direct the creation and maintenance of detection rules, correlation searches, behavioral analytics, alerting mechanisms, and monitoring use cases.
• Establish processes to measure and validate detection effectiveness, ATT&CK framework coverage, and monitoring performance across the enterprise.
• Lead efforts to improve detection fidelity, reduce false positives, minimize alert fatigue, and optimize analyst effectiveness.
• Direct adversary emulation, purple team, detection validation, and continuous assessment activities to improve defensive effectiveness.
• Drive automation and advanced analytics initiatives that improve monitoring scalability, operational efficiency, and response speed.

Incident Response & Cyber Defense

• Serve as the primary leadership escalation point for