Lead Threat Detection & Threat Hunting Engineer
Thomson Reuters7 days ago
Base Salary
$118k - $220k/yr
Responsibilities
- Architect, develop, implement, tune, and maintain scalable threat detection logic across Splunk, AWS, Azure, endpoint, identity, network, and other enterprise security data sources.
- Conduct proactive, hypothesis-driven threat hunts based on adversary behavior, threat intelligence, environmental changes, emerging threats, and defensive coverage gaps.
- Develop detection workflows, enrichment pipelines, correlation logic, and automation using Splunk, Torq, and other security technologies.
- Map detection coverage to MITRE ATT&CK, identify logging and telemetry gaps, and prioritize improvements based on risk and threat relevance.
- Operationalize threat intelligence, indicators of compromise, behavioral indicators, and adversary tradecraft into detection and hunting strategies.
- Develop cloud detection and hunting use cases covering AWS and Azure identity, IAM activity, control-plane events, workload activity, and cloud-native telemetry.
- Evaluate detection performance through analytics, testing, threat simulations, purple-team exercises, red-team findings, incident learnings, and false-positive analysis.
- Partner with Security Operations, Incident Response, Security Engineering, Cloud Engineering, and platform teams to improve detection quality, escalation criteria, alert context, and telemetry.
- Use and validate AI-enabled security and automation tools for detection development, hunting, research, analysis, documentation, and workflow development.
- Maintain detection documentation, lifecycle processes, testing standards, content ownership, tuning practices, and detection-as-code workflows.
- Mentor junior detection engineers and threat hunters and contribute to the strategic direction and operational maturity of the program.
Requirements
- At least 5 years of experience in threat detection engineering, threat hunting, security analytics engineering, cyber defense, threat intelligence, or a related cybersecurity discipline.
- Demonstrated experience developing, tuning, validating, and maintaining detection logic across SIEM, EDR, cloud-native security, or similar platforms.
- Strong hands-on Splunk experience, including searches, correlation logic, dashboards, detections, and security analytics content.
- Experience conducting proactive threat hunts using endpoint, identity, network, cloud, application, and infrastructure telemetry.
- Deep understanding of adversary tactics, techniques, and procedures and strong proficiency with the MITRE ATT&CK framework.
- Experience operationalizing threat intelligence and identifying logging, telemetry, data-quality, enrichment, and tooling gaps.
- Experience with AWS and/or Azure security telemetry and cloud detection or threat-hunting use cases.
- Experience scripting or automating security workflows with Python, PowerShell, SPL, KQL, SQL, or comparable languages.
- Ability to evaluate detection quality through testing, analytics, false-positive analysis, incident findings, hunting results, and coverage metrics.
- Strong written and verbal communication skills and demonstrated technical leadership, mentoring, or cross-functional security initiative experience.
- Preferred experience with Torq or comparable SOAR platforms, GCP or hybrid cloud environments, SIEM, EDR, SOAR, XDR, cloud security, identity security, network security, threat intelligence platforms, detection-as-code, automated testing, CI/CD pipelines, enrichment pipelines, and adversary simulation.
- Relevant certifications such as GCIA, GCTI, GCED, GCIH, OSCP, AWS Security Specialty, or Azure Security Engineer are beneficial but not required.
Benefits
- Flexible hybrid work model for office-based roles.
- Work-from-anywhere flexibility for up to 8 weeks per year and supportive work-life policies.
- Career development, continuous learning, skills-first growth programs, and tuition reimbursement.
- Comprehensive health, dental, vision, disability, life insurance, retirement savings with 401(k) match, vacation, sick and safe paid time off, holidays, parental leave, and sabbatical leave.
- Two company-wide Mental Health Days, Headspace access, wellbeing resources, fitness reimbursement, and Employee Assistance Program access.
- Two paid volunteer days annually, social-impact and pro-bono consulting opportunities, and ESG initiatives.
- Eligible US locations offer a base compensation range of $118,400-$219,800 plus potential annual bonus.
About Thomson Reuters
Thomson Reuters builds research platforms, workflow software, and data services for legal, tax and accounting, compliance, and government professionals, and operates the Reuters global news service. Flagship products include Westlaw for legal research and ONESOURCE and Checkpoint for tax and accounting, sold primarily via subscriptions and enterprise licenses. A public company headquartered in Toronto, it was formed in 2008 by combining Thomson Corporation and Reuters Group and is listed on the TSX and Nasdaq as TRI.