Director, Technology (Threat Exposure & Assurance Management)

American Electric Power; Columbus (OH); On-site; USD 189,000 - 245,000; Full time

Job summary

American Electric Power in Columbus, OH is seeking a Director of Threat Exposure & Assurance Management to lead enterprise remediation across infrastructure, networks, applications, platforms and cloud.

This role requires broad tech knowledge and deep security, vulnerability and risk analysis expertise, with responsibility for translating findings into practical engineering and operations while balancing risk and business impact.

Qualifications

• Bachelor’s degree in computer science, engineering, information security, business or related field.
• 10+ years of relevant work experience with at least 6 years in a leadership role.
• Substantive enterprise IT engineering, operations or technology delivery leadership.
• Experience delivering and operating enterprise technology services and coordinating teams.
• Broad knowledge of enterprise infrastructure, networking, applications, platforms and cloud.
• Strong knowledge of security principles, vulnerability management, risk exposure and remediation.
• Ability to influence without direct authority and align technology owners.

Responsibilities

• Define and execute an enterprise technology remediation strategy across infrastructure, networks, apps, platforms, cloud and shared services.
• Own end-to-end remediation lifecycle with intake, technical triage, accountable-owner assignment, tracking and closure. Establish service levels by severity and asset criticality, and hold delivery teams accountable for timelines.
• Prioritize work using exploitability, active exploitation, exposure, service dependencies and business impact with clear ownership and acceptance criteria.
• Coordinate cross-team delivery with technology owners, engineering and operations. Ensure plans address testing, change and release approvals, maintenance windows and patch deployment.
• Lead the CITO response to emergency vulnerabilities and zero-day exposures in partnership with Enterprise Cybersecurity, coordinating impact assessment and timely executive reporting.
• Serve as the single, accountable security liaison between Enterprise Cybersecurity and the CITO organization.
• Operate the central hub translating security requirements into prioritized work for technology spokes and embed shared delivery accountability.
• Resolve competing remediation priorities and negotiate resource allocation with technology leaders; evaluate trade-offs across security, scalability and availability.
• Where immediate remediation isn’t feasible, coordinate compensating controls and documented exceptions through governance.
• Maintain governance for intake, escalation, exceptions and change execution with clear ownership and business context.
• Drive patching and technology lifecycle modernization, configuration hardening and identity improvements to reduce attack surface.
• Eliminate systemic causes of recurring vulnerabilities through automation, Lean practices and dashboards to expose bottlenecks and root causes.
• Define, track and report open vulnerabilities by severity and remediation performance to improve outcomes.
• Build and lead a credible hub team through hiring, coaching and succession planning.

Skills

Leadership

Security leadership

Vulnerability management

Risk analysis

Enterprise IT engineering

Cross-team collaboration

Cloud & infrastructure

Education

Bachelor’s degree in Computer Science/Engineering/Info Security

Job description

Job Posting End Date

11-09-2026

Please note the job posting will close on the day before the posting end date.

Job Summary

The Director of Threat Exposure & Assurance Management is a senior technology leader within centralized IT who has built, delivered or operated enterprise services. The role requires broad knowledge of infrastructure, networks, applications, platforms and cloud, technical depth in at least one domain, and strong security, vulnerability and risk-analysis expertise. As the dedicated liaison for the Chief Information & Technology Officer (CITO) organization, the Director operates a hub-and-spoke model: the central hub coordinates priorities, governance and assurance, while technology owners execute remediation. Enterprise Cybersecurity owns policy, standards and threat intelligence; this role owns the speed and consistency of CITO execution and measurable risk reduction. The Director translates findings into practical engineering and operational work, balancing exploitability, exposure and business impact with testing, change discipline, service dependencies and availability. The role aligns execution with AEP risk tolerance and regulatory obligations while maturing people, processes and automation.

Job Description

What you’ll do:

• Define and execute an enterprise technology remediation strategy across infrastructure, networks, applications, platforms, cloud and shared services, aligned with Enterprise Cybersecurity policy, AEP risk tolerance and regulatory obligations.
• Own the end-to-end remediation lifecycle, including intake, technical triage, accountable-owner assignment, tracking, validation and closure. Establish service levels by severity and asset criticality, and hold delivery teams accountable for committed timelines.
• Prioritize work using exploitability, active exploitation, exposure, service dependencies, asset criticality and business impact rather than severity scores alone. Translate findings into executable engineering and operational work with clear ownership and acceptance criteria.
• Coordinate cross-team delivery with technology owners, engineering and operations. Ensure plans address testing, change and release approvals, maintenance windows, patch deployment, rollback readiness and service availability, and integrate remediation into application and service lifecycle processes.
• Lead the CITO response to emergency vulnerabilities and zero-day exposures in partnership with Enterprise Cybersecurity, coordinating impact assessment, containment, compensating controls, patching, validation and timely executive reporting.
• Serve as the single, accountable security liaison between Enterprise Cybersecurity and the CITO organization. Enterprise Cybersecurity owns policy, standards and threat intelligence; this role owns coordinated CITO execution and measurable risk reduction.
• Operate the central hub that translates security requirements, findings and directives into prioritized work for technology spokes. Build durable relationships with infrastructure, network, application, platform, cloud and operations leaders to embed shared delivery accountability.
• Resolve competing remediation priorities and negotiate resource allocation and sequencing with technology leaders. Partner with architecture and engineering to evaluate trade-offs among security, scalability, reliability, availability, operational stability and change risk.
• Where immediate remediation is not feasible, coordinate compensating controls and documented exceptions or risk-acceptance requests, routing decisions through established governance to authorized approvers.
• Maintain disciplined governance for intake, escalation, exceptions and change execution. Report remediation posture, progress and residual risk with clear ownership and business context; govern vendor and partner commitments to ensure verifiable outcomes without operational fragility.
• Drive patching and technology lifecycle modernization, configuration hardening, certificate and secrets management, identity and access improvements, and attack-surface reduction with accountable technology owners.
• Eliminate systemic causes of recurring vulnerabilities through engineering standards, automation and sustainable operating practices. Apply Lean practices to reduce cycle time, manual effort and handoff friction; use analytics and dashboards to expose bottlenecks, trends and root causes.
• Define, track and report open vulnerabilities by severity, mean time to remediate, service-level attainment, backlog age, recurrence and scan coverage, using these measures to improve execution and demonstrate risk reduction.
• Build and lead a technically credible hub team through hiring, coaching, performance management, talent development and succession planning. Foster an inclusive culture of collaboration, accountability and continuous learning.
• Enable the extended community of remediation owners with practical playbooks, escalation paths and shared delivery expectations so risk reduction becomes part of normal technology operations.

What We're Looking For:

Minimum Requirements:

Education

• Bachelor’s degree in computer science, engineering, information security, business or a related technical field, or an equivalent combination of education and related experience.

Experience

• A minimum of 10 years of relevant work experience, including 6 years in a leadership role, is required.

Additional Must Haves:

• Relevant experience must include substantive enterprise IT engineering, operations or technology delivery responsibilities and demonstrated leadership of cross-team technology execution.
• Proven experience delivering and operating enterprise technology services, implementing production changes, coordinating engineering and operations teams, and managing service dependencies and operational trade-offs. Candidates whose experience is primarily security policy, audit or advisory work must also demonstrate this required technology delivery and operational background.
• Broad working knowledge of enterprise infrastructure, networking, applications, platforms and cloud is required, including how these domains support business services. Substantive hands‑on engineering, operations or delivery experience and technical depth in at least one domain are required, with the ability to evaluate remediation plans across domains.
• Strong knowledge of security principles, vulnerability management, threat exposure, risk analysis and remediation practices is required. Must be able to interpret security findings and threat intelligence, assess exploitation potential and business impact, evaluate compensating controls, and translate risk into practical technology decisions and measurable outcomes.
• Demonstrated ability to influence without direct authority, align technology owners, resolve competing priorities and sequence work across organizational boundaries. Experience building and coaching teams, improving operating processes, and communicating technical risk and delivery trade‑offs to executive, security and technology stakeholders is required.

Preferred Skills and Qualifications:

• Experience translating regulatory and compliance obligations into technology operations across complex enterprise environments.
• Experience integrating vulnerability tools with asset, service and delivery processes, and using automation, analytics and root‑cause analysis to reduce recurring exposure.
• Experience supporting technology modernization and a commitment to a secure, resilient and sustainable energy future.

American Electric Power (On-Site)

#AEPCareers

At AEP, we’re more than just an energy company — we’re a team of dedicated professionals committed to delivering safe, reliable, and innovative energy solutions. Guided by our mission to put the customer first, we strive to exceed expectations by listening, responding, and continuously improving the way we serve our communities. If you're passionate about making a meaningful impact and being part of a forward‑thinking organization, this is the company for you!

Compensation Data

Compensation Grade:

SP20-012

Compensation Range:

$188,524.00 - $245,080.00

The Physical Demand Level for this job is: S – Sedentary Work: Exerting up to 10 pounds of force occasionally (Occasionally: activity or condition exists up to 1/3 of the time) and/or a negligible amount of force frequently. (Frequently: activity or condition exists from 1/3 to 2/3 of the time) to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time but may involve walking or standing for brief periods of time. Jobs are sedentary if walking and standing are required only occasionally, and all other sedentary criteria are met.

It is hereby reaffirmed that it is the policy of American Electric Power (AEP) to provide Equal Employment Opportunity in all respects of the employer‑employee relationship including recruiting, hiring, upgrading and promotion, conditions and privileges of employment, company sponsored training programs, educational assistance, social and recreational programs, compensation, benefits, transfers, discipline, layoffs and termination of employment to all employees and applicants without discrimination because of race, color, religion, sex (including pregnancy, gender identity, and sexual orientation), national origin, age, veteran or military status, disability, genetic information, or any other basis prohibited by applicable law. When required by law, we might record certain information or applicants for employment may be invited to voluntarily disclose protected characteristics.