Security Specialist (Senior to Staff Level)

This role is an individual contributor position within AEP's Cybersecurity Intelligence & Defense organization, serving as a highly technical frontline defender to safeguard the enterprise against insider risk.

About the role

The Insider Protection Analyst detects, investigates, and responds to risks originating from within the organization, protecting AEP's people, data, and critical infrastructure from intentional and unintentional insider activity. This includes building and maintaining security analytics, user activity monitoring, and analysis using data from various Cybersecurity and IT tools.

Responsibilities

• Implement and maintain analytical detections related to insider threat activity.
• Triage, respond to, and investigate alerts related to insider threat activity.
• Develop and maintain policies, procedures, and documentation for the insider threat program.
• Assist with projects and programs aimed at reducing insider risk.
• Conduct or support internal investigations, inquiries, data loss prevention, and digital forensics efforts, including documentation and referral of findings.
• Produce concise, insightful, and comprehensive investigative and analytic reports for both technical and executive audiences.
• Partner with internal business units to support user investigations, document findings, and escalate high-profile or sensitive matters.

Requirements

• Ability to obtain and maintain a U.S. government security clearance.
• Demonstrable technical ability to analyze disparate data sources related to insider risk monitoring and response.
• Demonstrable technical ability to build analytics detections pertinent to insider risk activity.
• Excellent written and verbal communication skills, with strong analytical and critical-thinking ability.
• Ability to handle sensitive and confidential information.

Qualifications

Education and experience requirements vary by level:

• Security Spec Sr (SG7):
  • Bachelor's degree, OR
  • Associate's degree with 2 years relevant experience in system administration/help desk/security, OR
  • High School Diploma/GED with 3 years relevant experience in IT system administration/help desk/security, OR
  • Graduation from an approved Cybersecurity Program, OR
  • Non-degree qualifications (e.g., demonstrated ability in a technical interview/assessment).
  • 2+ years of Information Technology related experience, OR 1+ years of security-related experience (may include military/government work).
• Security Spec Prin (SG8):
  • Bachelor's degree, OR
  • Associate's degree with 2 years relevant experience in system administration/help desk/security, OR
  • High School Diploma/GED with 4 years relevant experience in IT system administration/help desk/security, OR
  • Graduation from an approved Cybersecurity Program, OR
  • Non-degree qualifications (e.g., demonstrated ability in a technical interview/assessment).
  • 4+ years of Information Technology related experience, OR 2+ years of security-related experience (may include military/government work).
• Security Spec Lead (SG9):
  • Bachelor's degree, OR
  • Associate's degree with 2 years relevant experience in system administration/help desk/security, OR
  • High School Diploma/GED with 4 years relevant experience in IT system administration/help desk/security.
  • 7+ years of Information Technology related experience, OR 5+ years of security-related experience (may include military/government work).
• Security Spec Staff (SG10):
  • Bachelor's degree, OR
  • Associate's degree with 2 years relevant experience in system administration/help desk/security, OR
  • High School Diploma/GED with 4 years relevant experience in IT system administration/help desk/security.
  • 10+ years of Information Technology related experience, OR 5+ years of security-related experience (may include military/government work).

Preferred Qualifications

• Bachelor's degree in cybersecurity, information security, computer science, or a related field.
• Experience in cybersecurity, insider threat, security operations, digital forensics, data loss prevention, investigations, fraud detection, or intelligence analysis.
• Prior investigations experience.
• Experience conducting digital forensics in support of insider threat inquiries and investigations.
• Experience monitoring and investigating anomalous user activity and policy violations.
• Experience identifying insider risk indicators through analytics, UEBA platforms, and anomaly detection methodologies.
• Understanding of security monitoring tools, SIEM platforms, and endpoint detection solutions.
• Experience with Counterintelligence or understanding of foreign intelligence entities, international threat organizations, and associated Tactics, Techniques, and Procedures (TTPs).
• Ability to create and curate queries to detect and analyze data for potential insider activity.
• Experience working in cross-functional environments involving HR, Legal, Compliance, Privacy, and Security teams.
• Knowledge of cyber investigations and incident response processes.
• Experience with case management and evidence handling.
• Experience with data classification, information protection, data loss prevention (DLP), and sensitive data monitoring technologies.
• Familiarity with electric utility operations, industrial control systems (ICS/SCADA), or critical infrastructure protection frameworks (e.g., NERC CIP).
• Working knowledge of Python and other programming languages.
• Ability to use AI in threat detection and analysis.
• Knowledge of application defense mechanisms for AI use.

Preferred Certifications

• CERT Insider Threat Program Manager (ITPM) or Global Counter-Insider Threat Professional (GCITP).
• GIAC Certified Forensic Analyst (GCFA) or GIAC Certified Forensic Examiner (GCFE).
• GIAC Certified Intrusion Analyst (GCIA).
• Computer Hacking Forensic Investigator (CHFI).

Benefits

AEP offers a comprehensive benefits package aimed at supporting and enhancing the overall well-being of employees.

Pay

Base salary range: $87,633.00 – $177,503.00 per year.

Schedule

The physical demand level for this job is sedentary work, involving exerting up to 10 pounds of force occasionally and/or a negligible amount of force frequently. Sedentary work involves sitting most of the time but may include walking or standing for brief periods.