Security Specialist Principal

aep; Columbus (OH); On-site; USD 110,000 - 150,000; Full time

Job summary

American Electric Power is seeking a Detection Engineer to join our Cybersecurity Intelligence and Defense team in Columbus, OH. You will design, develop, and optimize high-fidelity detections across endpoints, networks, cloud, and identity environments to improve visibility and threat response.

Collaborate with Security Operations, Threat Hunting, Incident Response, and Intelligence teams to validate detections, reduce false positives, and drive data-driven improvements.

Qualifications

• Bachelor's degree or associate degree.

Responsibilities

• Design, develop, test, and deploy high-fidelity security detections across SIEM, EDR, NDR, and cloud.
• Translate threat intelligence and threat hunting findings into actionable detection content.
• Develop and maintain detection rules, correlation searches, and automated alerting.
• Tune detections to improve fidelity and reduce alert fatigue.
• Map detections to MITRE ATT&CK framework and improve visibility across the attack lifecycle.
• Collaborate with Threat Hunting, Incident Response, Security Operations, and Intelligence teams.
• Automate detection workflows and data onboarding to improve scalability.

Education

Bachelor's degree or associate degree

Job description

Job Posting End Date 10-27-2026 Please note the job posting will close on the day before the posting end date.

Job Summary

We are seeking a highly motivated Detection Engineer to join our Cybersecurity Intelligence and Defense team. The Detection Engineer is responsible for designing, developing, and optimizing advanced detection capabilities that identify malicious activity across endpoint, network, cloud, identity, and application environments. This role leverages threat intelligence, threat hunting findings, adversary behaviors, and enterprise telemetry to create high-fidelity detections that improve visibility, accelerate threat identification, and strengthen AEP's overall cybersecurity posture. The Detection Engineer partners closely with Security Operations, Threat Hunting, Incident Response, and Intelligence teams to continuously improve detection coverage, validate detection effectiveness, and reduce the time required to detect and respond to cyber threats.

Job Description

What you'll do:

Essential Job Functions & Tasks

Key Responsibilities

• Design, develop, test, validate, and deploy high-fidelity security detections across SIEM, EDR, NDR, cloud, identity, and other security monitoring platforms.
• Drive continuous improvement of the detection engineering program through telemetry enrichment, detection validation, purple team exercises, and data-driven measurement of detection effectiveness and operational outcomes.
• Translate threat intelligence, threat hunting findings, incident response lessons learned, and emerging adversary tradecraft into actionable detection content and monitoring strategies.
• Develop and maintain detection rules, correlation searches, behavioral analytics, anomaly detections, and automated alerting mechanisms to identify malicious activity.
• Tune and optimize detections to improve fidelity, reduce false positives, minimize alert fatigue, and increase analyst efficiency.
• Map detections to the MITRE ATT&CK framework, assess detection coverage, and identify opportunities to improve visibility across the attack lifecycle.
• Collaborate with Threat Hunting, Incident Response, Security Operations, and Intelligence teams to validate detections and strengthen AEP's detection and response capabilities.
• Research, develop, and operationalize detection use cases for emerging threats, novel attack techniques, and evolving adversary behaviors.
• Analyze and leverage security telemetry from endpoints, networks, cloud environments, identity providers, applications, and other enterprise data sources to develop detections and improve visibility.
• Measure and report on detection performance, effectiveness, and coverage.
• Support purple team exercises, tabletop exercises, and adversary emulation activities.
• Develop, maintain, and enhance detection engineering standards, documentation, use case libraries, and engineering processes.
• Automate detection engineering workflows, content deployment, testing, validation, and quality assurance processes to improve scalability and efficiency.
• Identify security telemetry gaps and partner with technology owners to onboard, normalize, enrich, and operationalize new data sources that enhance detection capabilities.
• Design, deploy, and maintain deception technologies, including decoys, honeypots, and deceptive credentials, to detect and disrupt adversary activity across the enterprise.
• Analyze deception events and attacker interactions to identify adversary behaviors, support investigations, and improve detection and response capabilities.

Nice to have:

• Licenses and Certifications: CSFA, GCCC, GCDA, GCED, GCFA, GCFE, GCIA, GCIH, GCIP, GCTI, GDAT, GICSP, GMON, GOSI, GREM, GRID, GSOM, GXPN, OSCP, OSEE, Treadstone Certified Threat Intelligence Analyst/Certified Threat Counterintelligence Analyst, CERT IncidentResponse Process Professional, CREST Certified Host Intrusion Analyst, CREST Certified Incident manager, CREST Certified malware Reverse Engineer, CREST Certified Network Intrusion Analyst, CREST Certified Threat Intelligence Manager

Experience:

Experience: Demonstrable experience in one or more of the following disciplines:

• - Detection Engineer
• - Incident Response Analyst
• - CIRC/SOC Lead
• - Threat Intelligence or Counterintelligence Analyst
• - Cyber Threat Hunt Analyst
• - Malware Reverse Engineer

What We're Looking For:

Education requirements are listed below: Bachelor's degree or associate degr