Distinguished Engineer, AI Threat Defense

Thomson Reuters is enhancing its Cyber Defense capability in response to an AI-driven threat landscape that has fundamentally changed the speed, scale, and nature of cyberattacks.

The Distinguished Engineer, AI Threat Defense is an individual contributor and senior technical authority embedded within the existing 60+ person Cyber Defense organization. Reporting to the VP of Cyber Defense, this individual will strengthen AI-specific threat defense strategy and build AI-augmented detection and response capability into the existing Security Operations Center (SOC) and Cyber Incident Response Team (CIRT).

This role has no direct reports or management authority
. Instead, the individual will drive impact through technical credibility, architecture, hands‑on engineering, influence, and mentorship across SOC Operations, CIRT, Threat Detection Engineering, Vulnerability Management, Attack Surface Reduction, and Cyber Threat Management.

The role also owns two areas where the current organization lacks a dedicated deep technical owner: the technical strategy against AI-specific attack vectors and the hands‑on architecture and delivery of AI-augmented detection and response within the existing SOC and CIRT.

• Own Thomson Reuters’ monitoring and response strategy against AI-specific attack vectors including
  prompt injection, Model Context Protocol (MCP) exploitation, agentic system compromise, deepfake-enabled social engineering, and AI-assisted reconnaissance
  .

• Partner with Security Engineering and Architecture to define standards for securing AI infrastructure and ensuring it can be effectively monitored and defended.

• Track emerging offensive AI capabilities, adversary tooling, published research, and threat‑actor adoption of AI so Cyber Defense capabilities evolve ahead of emerging threats.

Drive monitoring and defenses for AI‑specific threat classes including:

• Direct and indirect prompt injection

• Jailbreaks and guardrail bypass

• Sensitive‑information and system‑prompt disclosure

• Unsafe model output and downstream execution

• Excessive agency and MCP/tool abuse

• Model and data poisoning

• AI supply‑chain compromise

• Model denial‑of‑service / denial‑of‑wallet attacks

• Model, prompt, and intellectual‑property theft

Own technical monitoring and response for Thomson Reuters AI‑enabled applications, features, and agentic services while partnering with Product Engineering, Security Engineering & Architecture, and App Sec to embed security directly into the software development lifecycle.

• Build AI‑augmented detection content and analytics for AI‑specific attack patterns.

• Integrate AI threat detection into the existing SIEM, detection engineering, and SOC monitoring stack
  .

• Build AI‑assisted playbooks and runbooks and integrate them into existing CIRT and SOAR workflows
  .

• Serve as the principal technical architect for incorporating AI capabilities into the existing 24/7 SOC and CIRT rather than creating a separate security function.

• Design automated workflows for AI‑related detection, triage, investigation, and response.

• Increase analyst productivity while maintaining human‑in‑the‑loop controls, audit trails, and rollback capability.

• Drive adoption across SOC Operations, CIRT, Threat Detection Engineering, Vulnerability Management, and Attack Surface Reduction.

• Act as the recognized technical authority for AI threat defense across the Cyber Defense organization.

• Provide hands‑on mentorship and technical uplift to SOC, CIRT, engineering, and security professionals without formal management responsibility.

• Represent Cyber Defense externally with industry groups,…