Senior Threat Detection & AI Analytics Lead

Thomson Reuters; Richmond (VA); Hybrid; USD 118,000 - 220,000; Full time

Benefits offered by this job

Hybrid Work Model

Flex My Way

Career Development

Competitive Benefits

Two Mental Health Days off

Tuition Reimbursement

Employee Stock Purchase Plan

Job summary

Thomson Reuters is strengthening its Cyber Threat Management capability to protect the organization, its products, and its customers from evolving cyber threats. The Lead Cyber Threat Management Analyst will lead the design and continuous improvement of advanced threat detection capabilities across the enterprise, building scalable detection logic and operationalizing threat intelligence.

You will collaborate with Security Operations, Threat Intelligence, Incident Response, Security Engineering,

Qualifications

• 5+ years in threat detection engineering, security operations, incident response, threat intelligence, or related cybersecurity discipline.
• Experience tuning detection logic across SIEM, EDR, cloud-native security tools, or similar technologies.
• Strong proficiency with MITRE ATT&CK including detection mapping, coverage analysis, and defensive gaps.
• Experience scripting or automating security workflows using Python, PowerShell, or comparable languages.
• Ability to develop and improve data enrichment, detection automation, alert triage, and investigation workflows.
• Excellent written and verbal communication to explain technical risks, findings, and recommendations to stakeholders.

Responsibilities

• Architect, develop, implement, and maintain scalable threat detection logic across SIEM, EDR, cloud-native security platforms, and other enterprise security data sources.
• Design and tune detections to identify emerging threats, suspicious activity, adversary behaviors, and indicators of compromise while minimizing false positives.
• Map detections to MITRE ATT&CK framework to assess defensive coverage and prioritize improvements.
• Operationalize threat intelligence into actionable detection and monitoring strategies.
• Collaborate with Threat Intelligence, Incident Response, SOC, and Security Engineering teams to validate detection effectiveness.
• Analyze security logs, alerts, telemetry, and behavioral data to identify patterns and anomalies.
• Lead development and optimization of detection workflows, enrichment pipelines, and automation to improve investigations.
• Use AI-enabled security tools responsibly to accelerate detection development and triage, while validating outputs.
• Evaluate detection performance through analytics, testing, and incident findings.
• Incorporate findings from incidents and threat research into content improvements.
• Partner with Incident Response to investigate gaps and strengthen containment workflows.
• Develop and maintain documentation for detection logic, data sources, and use cases.
• Mentor junior detection engineers and analysts.
• Contribute to strategic direction and long-term roadmap of Threat Detection.
• Participate in cross-functional security initiatives and design reviews.

Skills

Threat detection engineering

Security operations

Incident response

Threat intelligence

MITRE ATT&CK

Automation

Python

PowerShell

Team leadership

Cross-functional collaboration

Tools

SIEM

EDR

Cloud-native tools

SOAR

XDR

Threat intel platforms

Job description

Thomson Reuters is strengthening its Cyber Threat Management capability to protect the organization, its products, and its customers from evolving cyber threats. The Lead Cyber Threat Management Analyst will lead the design and continuous improvement of advanced threat detection capabilities across the enterprise, building scalable detection logic and operationalizing threat intelligence.

You will collaborate with Security Operations, Threat Intelligence, Incident Response, Security Engineering,