Senior Threat Detection & Hunting Architect

USA018 Thomson Reuters Holdings Inc.; Richmond (VA); Hybrid; USD 118,000 - 220,000; Full time

Benefits offered by this job

401k plan with company match

Mental health days

Job summary

Thomson Reuters is strengthening its Cyber Threat Management capability. The Lead Threat Detection & Threat Hunting Engineer will lead development, tuning, and continuous improvement of threat detection across enterprise data sources including Splunk and cloud environments.

You will work with Security Operations, Threat Intelligence, Incident Response, and cloud teams to operationalize threat intelligence and automate detection content.

Qualifications

• 5+ years of experience in threat detection engineering, threat hunting, or related cybersecurity roles.
• Experience developing, tuning, and validating detection logic across multiple security platforms.
• Hands-on Splunk experience with searches, dashboards, detections, and analytics content.
• Experience with threat hunting using endpoint, identity, network, cloud telemetry.
• Strong understanding of adversary tactics, techniques, and procedures.
• Proficiency with MITRE ATT&CK framework and detection mapping.

Responsibilities

• Architect, develop, and maintain scalable threat detection logic across data sources (Splunk, cloud, endpoint, identity, network).
• Conduct proactive threat hunts based on adversary tactics and threat intelligence.
• Design and tune detection content to identify threats while minimizing false positives and alert fatigue.
• Map detection coverage to MITRE ATT&CK and prioritize improvements based on risk.
• Identify telemetry gaps and partner with engineering teams to implement improvements.
• Operationalize threat intelligence into actionable detection and hunting strategies.
• Develop detection and hunting use cases for AWS and Azure environments.

Skills

Threat detection engineering

Threat hunting

Security analytics

Python scripting

Cloud security

MITRE ATT&CK

Strong communication

Tools

Splunk

Torq

AWS

Azure

Job description

Thomson Reuters is strengthening its Cyber Threat Management capability. The Lead Threat Detection & Threat Hunting Engineer will lead development, tuning, and continuous improvement of threat detection across enterprise data sources including Splunk and cloud environments.

You will work with Security Operations, Threat Intelligence, Incident Response, and cloud teams to operationalize threat intelligence and automate detection content.