Security Specialist Lead

Job Posting End Date
10-19-2026

Please note the job posting will close on the day before the posting end date.

Job Summary The Counterintelligence Investigator is an individual contributor responsible for detecting, investigating, and responding to risks, helping to protect AEP's people, data, and critical infrastructure from intentional and unintentional insider activity.

This role operates within AEP's Cybersecurity Intelligence & Defense organization and serves as a highly technical frontline defender in safeguarding the enterprise against insider and counterintelligence risk. Responsibilities include building and maintaining security analytics and conducting analysis utilizing data from a variety of cybersecurity tools. This position conducts focused monitoring and translates risk signals into actionable findings that reduce organizational risk.

This position also drives programs and policies related to Counterintelligence.

Job Description The Counterintelligence Investigator partners closely with internal business partners to provide support for user investigations, documents findings through case management systems, and escalates high-profile or sensitive matters for further investigation and response. This position also writes comprehensive reports and is able to translate highly technical findings into common business language for various stakeholders.

What You'll Do Essential Job Functions & Tasks Identify, implement, and maintain counterintelligence (CI) controls to protect critical infrastructure and operational technology (OT) from nation-state cyber threats, malicious insiders, espionage, and supply chain exploitation.

Detect, monitor, and assess nation-state efforts targeting the collection of sensitive, proprietary, or operationally critical information.

Develop and maintain CI policies, procedures, and threat assessments, and analyze quantitative and qualitative data to evaluate and improve the effectiveness of CI programs.

Conduct or support CI inquiries, investigations, and digital forensics efforts, including the documentation and referral of findings to appropriate stakeholders.

Produce concise, insightful, and comprehensive investigative and analytic deliverables for both technical and executive audiences.

Perform targeted CI and supply chain risk assessments to inform enterprise risk decisions.

Deliver counterintelligence awareness training.

Conduct pre and post travel briefings and debriefings.

Work independently with minimal oversight while collaborating effectively across business partner teams.

Required Qualifications and Skills Ability to obtain and maintain a U.S. government security clearance.

Demonstrated experience conducting or supporting one or more CI mission functions — operations, investigations, collections, analysis and production, or functional services.

Excellent written and verbal communication skills, with strong analytical and critical-thinking ability.

Experience conducting interviews, briefings, and debriefings.

Experience conducting investigations with national security implications.

Preferred Qualifications Experience conducting analysis of forensic outputs in support of insider threat and/or counterintelligence inquiries and investigations.

Familiarity with electric utility operations, industrial control systems (ICS/SCADA), or critical infrastructure protection frameworks.

Knowledge and experience with threat actor Tactics Techniques and Procedures Experience conducting large scale investigations involving various U.S. government agencies.

Preferred Certifications and Courses One or more insider threat certifications:
Global Counter-Insider Threat Professional (GCITP), CERT Insider Threat Program Manager (ITPM), Certified Counter-Insider Threat Professional (CCITP-F, CCITP-A)
Graduate of a credentialed counterintelligence special agent course (e.g., CISAC, DCAC, or equivalent) or a comparable federal investigations training program.

One or more all-source analyst courses/certifications such as:
Certified Department of Defense All-Source Analyst (CDASA) or Professional Analyst Career Education (PACE)
One or more forensic/security certifications: GIAC Certified Forensic Examiner (GCFE), GIAC Certified Forensic Analyst (GCFA)
One or more interview/interrogation courses/certifications

What We're Looking For:

Security Spec Lead (SG9):

Education requirements are listed below:

Bachelor's degree OR Associates degree with 2 years relevant experience in system administration/help desk/security (cyber or…