Security Specialist Principal

American Electric Power; Columbus (OH); On-site; USD 99,000 - 129,000; Full time

Benefits offered by this job

Base salary

Annual bonus

Long-term incentive

401(k) match

AEP Pension

Comprehensive benefits package

Job summary

American Electric Power seeks a Detection Engineer to design and optimize high-fidelity detections across endpoints, networks, cloud, and identities. You will leverage threat intelligence, threat hunting findings, and telemetry to enhance visibility and accelerate threat detection, working with SOC, Incident Response, and Intelligence teams.

The role emphasizes reducing false positives, automating detection workflows, and contributing to cyber deception initiatives.

Qualifications

• Bachelor’s degree or higher with IT/security experience or Cybersecurity program completion.
• 4+ years IT/security experience for non-degree path.
• Ability to translate threat intel into detection content.

Responsibilities

• Design, develop, test, validate, and deploy high-fidelity detections across SIEM, EDR, NDR, cloud, and identity platforms.
• Drive continuous improvement of the detection engineering program through telemetry and validation.
• Translate threat intelligence and incident lessons into actionable detection content and monitoring strategies.
• Develop and maintain detection rules, correlation searches, analytics, and automated alerts.
• Tune detections to improve fidelity and reduce false positives.
• Map detections to MITRE ATT&CK and improve visibility across attack lifecycle.
• Collaborate with Threat Hunting, Incident Response, Security Operations, and Intelligence teams.
• Research and operationalize detection use cases for emerging threats and attacker behaviors.
• Analyze telemetry from endpoints, networks, cloud, identities, and apps to improve visibility.
• Measure detection performance and coverage; support purple team and tabletop exercises.
• Develop, maintain, and improve detection engineering standards and processes.
• Automate workflows, deployment, testing, and QA for detections.
• Onboard new data sources and deception technologies to enhance detection capabilities.
• Analyze deception events to understand attacker behaviors and improve response.

Skills

Threat detection

Incident response

Threat hunting

Security operations

MITRE ATT&CK

Deception technologies

Data analytics

Education

Bachelor’s or associate degree with IT/security experience

High School Diploma with 4 years IT/security experience

Cybersecurity program graduate

Job description

Job Summary

We are seeking a highly motivated Detection Engineer to join our Cybersecurity Intelligence and Defense team. The Detection Engineer is responsible for designing, developing, and optimizing advanced detection capabilities that identify malicious activity across endpoint, network, cloud, identity, and application environments. This role leverages threat intelligence, threat hunting findings, adversary behaviors, and enterprise telemetry to create high-fidelity detections that improve visibility, accelerate threat identification, and strengthen AEP’s overall cybersecurity posture. The Detection Engineer partners closely with Security Operations, Threat Hunting, Incident Response, and Intelligence teams to continuously improve detection coverage, validate detection effectiveness, and reduce the time required to detect and respond to cyber threats.

In addition, the role supports cyber deception initiatives by integrating deception telemetry, validating attack-path visibility, and leveraging insights from deceptive technologies to enhance detection fidelity and provide early warning of adversary activity. The ideal candidate possesses a deep understanding of adversary tactics, techniques, and procedures (TTPs), security monitoring technologies, and data analytics. This expertise is applied to enhance detection coverage, reduce false positives, improve operational effectiveness, and strengthen the organization’s overall cyber resilience.

Job Description

What you’ll do:

Essential Job Functions & Tasks

Key Responsibilities

• Design, develop, test, validate, and deploy high-fidelity security detections across SIEM, EDR, NDR, cloud, identity, and other security monitoring platforms.
• Drive continuous improvement of the detection engineering program through telemetry enrichment, detection validation, purple team exercises, and data-driven measurement of detection effectiveness and operational outcomes.
• Translate threat intelligence, threat hunting findings, incident response lessons learned, and emerging adversary tradecraft into actionable detection content and monitoring strategies.
• Develop and maintain detection rules, correlation searches, behavioral analytics, anomaly detections, and automated alerting mechanisms to identify malicious activity.
• Tune and optimize detections to improve fidelity, reduce false positives, minimize alert fatigue, and increase analyst efficiency.
• Map detections to the MITRE ATT&CK framework, assess detection coverage, and identify opportunities to improve visibility across the attack lifecycle.
• Collaborate with Threat Hunting, Incident Response, Security Operations, and Intelligence teams to validate detections and strengthen AEP’s detection and response capabilities.
• Research, develop, and operationalize detection use cases for emerging threats, novel attack techniques, and evolving adversary behaviors.
• Analyze and leverage security telemetry from endpoints, networks, cloud environments, identity providers, applications, and other enterprise data sources to develop detections and improve visibility.
• Measure and report on detection performance, effectiveness, and coverage.
• Support purple team exercises, tabletop exercises, and adversary emulation activities.
• Develop, maintain, and enhance detection engineering standards, documentation, use case libraries, and engineering processes.
• Automate detection engineering workflows, content deployment, testing, validation, and quality assurance processes to improve scalability and efficiency.
• Identify security telemetry gaps and partner with technology owners to onboard, normalize, enrich, and operationalize new data sources that enhance detection capabilities.
• Design, deploy, and maintain deception technologies, including decoys, honeypots, and deceptive credentials, to detect and disrupt adversary activity across the enterprise.
• Analyze deception events and attacker interactions to identify adversary behaviors, support investigations, and improve detection and response capabilities.

Nice to have:

Licenses and Certifications: CSFA, GCCC, GCDA, GCED, GCFA, GCFE, GCIA, GCIH, GCIP, GCTI, GDAT, GICSP, GMON, GOSI, GREM, GRID, GSOM, GXPN, OSCP, OSEE, Treadstone Certified Threat Intelligence Analyst/Certified Threat Counterintelligence Analyst, CERT Incident

Response Process Professional, CREST Certified Host Intrusion Analyst, CREST Certified Incident manager, CREST Certified malware Reverse Engineer, CREST Certified Network Intrusion Analyst, CREST Certified Threat Intelligence Manager

Experience:

Demonstrable experience in one or more of the following disciplines:

• Detection Engineer
• Incident Response Analyst
• CIRC/SOC Lead
• Threat Intelligence or Counterintelligence Analyst
• Cyber Threat Hunt Analyst
• Malware Reverse Engineer

What We’re Looking For:

Education requirements are listed below:

• Bachelor’s degree or associate degree with 2 years relevant experience in system administration/help desk/security (cyber or physical) OR High School Diploma/GED with 4 years relevant experience in IT system administration/help desk/security (cyber or physical); OR graduation from an approved Cybersecurity Program; alternatively, may have non-degree qualifications (such as hands-on demonstrated ability in a technical interview/assessment).

Work Experience requirement listed below:

• 4 or more years of Information Technology related experience; OR 2 or more years of security related experience, which may include military/government work experience in addition to any experience identified above.

Clearance: Current government security clearance or ability to obtain a security clearance at a minimum of the Secret level.

What You’ll Get:

• Base salary
• Annual bonus
• Long-term incentive
• 401(k) match
• AEP Pension
• Comprehensive benefits package designed to support and enhance the overall well-being of employees.

At AEP, we’re more than just an energy company — we’re a team of dedicated professionals committed to delivering safe, reliable, and innovative energy solutions. Guided by our mission to put the customer first, we strive to exceed expectations by listening, responding, and continuously improving the way we serve our communities. If you’re passionate about making a meaningful impact and being part of a forward-thinking organization, this is the company for you!

Compensation Data

Compensation Grade:

SP20-009

Compensation Range:

$98,993.00 - $128,688.00

The Physical Demand Level for this job is: S – Sedentary Work: Exerting up to 10 pounds of force occasionally (Occasionally: activity or condition exists up to 1/3 of the time) and/or a negligible amount of force frequently. (Frequently: activity or condition exists from 1/3 to 2/3 of the time) to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time but may involve walking or standing for brief periods of time. Jobs are sedentary if walking and standing are required only occasionally, and all other sedentary criteria are met.

It is hereby reaffirmed that it is the policy of American Electric Power (AEP) to provide Equal Employment Opportunity in all respects of the employer-employee relationship including recruiting, hiring, upgrading and promotion, conditions and privileges of employment, company sponsored training programs, educational assistance, social and recreational programs, compensation, benefits, transfers, discipline, layoffs and termination of employment to all employees and applicants without discrimination because of race, color, religion, sex (including pregnancy, gender identity, and sexual orientation), national origin, age, veteran or military status, disability, genetic information, or any other basis prohibited by applicable law. When required by law, we might record certain information or applicants for employment may be invited to voluntarily disclose protected characteristics.