Principal Threat Architect, AI-Era Detection & Response

Trend Micro

About The Position

TrendAI™, the global AI security leader and enterprise business unit of Trend Micro, empowers organizations with full AI visibility and consolidated security that inspires confidence, drives innovation, and eliminates risk. At TrendAI™, we’re always seeking exceptional talent; people who want to collaborate with the best and push boundaries together. Here, your work goes beyond building a career. You will help protect what matters and play a vital role in shaping a safer, more trustworthy AI-powered future. Our Security Research & Development group sits at the frontier of AI-era cyber defense. We study how attackers are beginning to weaponize artificial intelligence, how AI is reshaping detection and response, and what durable capabilities defenders will need over the next several years. We are not a day-to-day operations team. Our charter is to research, prototype, and design the core capabilities that will anchor our platform and our customers' defenses for the next generation. We are seeking a Principal Threat Architect to research the frontier of AI-era threats and defensive technologies and to design the core detection-and-response capabilities that will anchor our platform for the next several years. This is a senior individual-contributor role at the intersection of threat research and systems architecture. You will study emerging threats and newly viable technologies, prototype and validate novel defensive approaches, and converge open-ended research into durable, production-grade operational architecture. You will work across disciplines — threat intelligence, detection engineering, AI/ML, and platform engineering — to translate what you learn into foundational capabilities rather than point solutions. Success in this role means the architecture you design today is still the foundation defenders build on years from now.

Requirements

Bachelor's degree in computer science, engineering, or a related technical field, or equivalent practical experience.
8+ years in cybersecurity, with demonstrable depth in threat detection and response.
Proven track record designing and delivering complex technical systems from concept through production deployment.
Hands-on experience architecting scalable systems that integrate with existing security tooling and operational workflows.
Working familiarity with AI/ML concepts and their application to threat detection, prevention, or response, including awareness of AI-specific threats and frameworks such as MITRE ATT&CK.
Experience in a research, R&D, or emerging-technologies function, with a demonstrated ability to take ambiguous, open-ended problems and converge them into concrete specifications.
Proficiency in at least one production programming language (e.g., Python).
Strong written and verbal communication, including conveying complex technical concepts to varied audiences.
Must be legally authorized to work in the United States.

Nice To Haves

Master's in computer science, machine learning, or a security-related discipline.
Direct experience with AI/ML security — securing ML/GenAI models, adversarial ML, or defending against AI-enabled attacks — aligned with frameworks such as the OWASP Top 10 for LLMs.
Experience building or operating detection-and-response platforms (EDR / XDR / MDR, SIEM, SOAR) or agentic SOC architectures.
Hands-on experience with large-scale data-processing systems and modern distributed architectures.
Proficiency in systems languages such as C/C++ or Rust in addition to Python.
Familiarity with cloud security across AWS, Azure, or GCP and with hybrid/multi-cloud environments.
Publication, patent, or conference-presentation record in threat research or applied AI security.
Experience within a vendor CTO office, security research lab, or comparable innovation function.

Responsibilities

Threat & technology research. Research the evolving AI-era threat landscape — including AI-enabled attacks and threats to AI systems themselves (e.g., prompt injection, model misuse, data leakage) — and translate findings into defensive strategy.
Architecture & capability design. Design new threat operational architecture: scalable, robust detection-and-response systems that integrate with existing security tooling, data pipelines, and analyst workflows.
Prototyping & experimentation. Envision, build, and validate prototypes that demonstrate the feasibility and impact of novel defensive approaches; converge open-ended research into concrete, supportable specifications.
Research-to-production bridge. Partner with detection engineering, data science, and platform teams to transition prototypes from early-stage design into durable, production-grade capabilities.
Technical leadership. Provide principal-level technical leadership on core design decisions and trade-offs; set direction that peers and adjacent teams build upon.
Communication & influence. Communicate complex research and architectural direction clearly to technical and non-technical audiences, including leadership; contribute to thought leadership as appropriate.