Lead Threat Detection Engineer

Refinitiv; Richmond (VA); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Mental Health Days off

401k with company match

Tuition reimbursement

Job summary

Thomson Reuters is seeking a Lead Cyber Threat Management Analyst to design, develop, and continuously improve advanced threat detection across SIEM, EDR, and cloud platforms. You will lead detection content development, operationalize threat intelligence, and collaborate with Security Operations, Threat Intelligence, Incident Response, and Engineering to reduce risk in a diverse technology environment.

You will drive mature detection strategies, minimize false positives, and guide analysts

Qualifications

• 5+ years in threat detection engineering, security operations, or related cybersecurity discipline.
• Experience developing, tuning, and maintaining detection logic across multiple security platforms.
• Strong ability to translate threat intelligence into practical detection use cases.

Responsibilities

• Architect, develop, and maintain scalable threat detection logic across SIEM, EDR, cloud platforms.
• Tune detections to identify threats while minimizing false positives and alert fatigue.
• Map detections to MITRE ATT&CK to assess coverage and gaps.
• Operationalize threat intelligence into actionable monitoring strategies.
• Collaborate with Threat Intelligence, Incident Response, and Security Engineering to validate effectiveness and improve workflows.
• Analyze logs, telemetry, and behavioral data to identify patterns and anomalies.
• Lead development of detection workflows and automation to speed investigations.
• Use AI-enabled security tools to accelerate detection, while validating outputs.

Skills

Threat detection engineering

SIEM & EDR

MITRE ATT&CK

Threat intel operationalization

Python/PowerShell

Cloud security

Leadership

Tools

SIEM

EDR

Cloud security

Job description

Thomson Reuters is seeking a Lead Cyber Threat Management Analyst to design, develop, and continuously improve advanced threat detection across SIEM, EDR, and cloud platforms. You will lead detection content development, operationalize threat intelligence, and collaborate with Security Operations, Threat Intelligence, Incident Response, and Engineering to reduce risk in a diverse technology environment.

You will drive mature detection strategies, minimize false positives, and guide analysts