Steven Thomson

Part of the IT Leaders 100 - a list of the most influential IT leaders in the UK in 2025.

Steven Thomson is the Head of Cyber Alert Response & Threat Intelligence at TJX and a Chartered Cyber Security Professional in Secure Operations. With expertise in detection engineering, SecOps, threat intelligence, threat hunting, incident response, and all aspects of cyber defence tooling, Steven's work is pivotal in securing global operations.

One of Steven's standout achievements in a previous role was preventing a critical cyber event from disrupting the administration and release of the first COVID vaccine on 4th Jan 2021.

His professional passion lies in team development, believing that investing in people is key to driving success and building resilient SecOps teams.

What's the most exciting part of your current role?

Being on the front line of defending a global retail network against constantly evolving threats. Each day brings new challenges - whether it's uncovering novel attack techniques, responding to targeted phishing campaigns, or tracking threat actors focused on the retail sector.

I lead a high-performing team that doesn't just detect threats - we turn intelligence into action, closing security gaps before they're exploited. We connect the dots between raw data and operational response, translating complex indicators into meaningful defence.

Just as rewarding is the opportunity to develop others and create an environment where people can grow, thrive, and achieve their full potential. Building that culture of trust, curiosity, and continuous learning is what transforms a good team into an exceptional one. Seeing individuals step up, lead, and evolve in their roles is one of the most fulfilling parts of what I do.

What do you consider your greatest IT achievement of the last 12 months?

Leading the transformation of a newly formed team - early in their careers and low in technical capability - into a highly competent, self-driven and collaborative SecOps unit. What makes this journey so rewarding is not just the technical progress, but the mindset shift. Each team member now embraces growth, proactively develops their skills, and actively supports their peers to achieve success together.

This didn't happen by chance. I introduced a clear capability roadmap, new training strategies, and most importantly, brought the team along on the journey - always explaining the 'why' behind our goals. By giving them ownership and accountability, they saw firsthand how their efforts translated into results.

A key part of the transformation was gamification. We implemented a system that not only tracked individual progression but also gave visibility into how each person's development compared to their peers - creating healthy motivation and a sense of shared purpose.

Seeing this team evolve into a confident, capable force in our cyber defence efforts has been a truly proud moment - and a reminder that with the right environment, people can exceed every expectation.

What's the biggest challenge facing IT leaders today, and how are you tackling it?

From a SecOps perspective, it’s balancing speed and agility with security and resilience. As organisations rapidly digitise, adopt cloud and support hybrid work, the attack surface expands - and adversaries are quick to take advantage. At the same time, security teams are overwhelmed by alert volume, tool complexity and skills shortages, all while being expected to respond in near real-time.

To address this, I've adopted a threat-informed approach to SecOps - ensuring our efforts are guided by real-world threat intelligence and aligned to the tactics and techniques most relevant to our environment. This helps us prioritise, focus our defences, and measure our effectiveness more meaningfully.

Looking ahead, I plan to leverage agentic AI and automation to scale our capabilities further. By embedding AI-driven decision support and intelligent automation into our workflows, we'll reduce manual noise, accelerate triage, and give analysts the space to focus on high-impact work. The goal isn't to replace people, but to augment them - creating a more proactive, resilient and adaptive security operation that keeps pace with the evolving threat landscape.

What piece of technology could you not live without, and why?

In our evolving SecOps landscape, the one capability I couldn't live without is centralised visibility and detection - whether delivered via a traditional SIEM or through a modern, SIEM-less architecture. While SIEMs have long been foundational, they can be costly, rigid, and struggle to keep pace with cloud-native environments.

That's why I'm increasingly drawn to SIEM-less models that leverage data lakes, detection-as-code and decoupled analytics. These approaches give us greater flexibility, scalability and cost control. We can store raw telemetry in low-cost storage and run detections using cloud-native or open-source tools - tailoring logic to our threat model and business needs.

The critical element isn't the tool - it's the capability: the ability to ingest, correlate, detect and respond at speed. Whether through a traditional SIEM or a modular, SIEM-less stack, that visibility layer is essential. It's what enables us to operationalise threat intelligence, prioritise detections, and respond with confidence.

What excites you most about the future of IT?

The shift from reactive defence to intelligent, adaptive operations - powered by automation, AI and a threat-informed mindset. We're moving beyond just managing alerts and logs to building systems that learn, anticipate, and respond with precision.

Agentic AI has the potential to transform how we operate - automating repetitive tasks, surfacing context-rich insights in real time and even taking autonomous actions within defined guardrails. This means analysts can focus less on triage and more on high-value threat hunting, engineering and strategy.

Equally exciting is the growing maturity of threat-informed defence. By aligning our detection and response efforts to real-world adversary behaviours, we can prioritise what truly matters - closing gaps proactively and measuring effectiveness in a meaningful way.

Combined with cloud-native architectures and scalable, SIEM-less approaches, the SecOps of the future will be leaner, smarter, and more resilient. It won't be about more tools - it'll be about smarter operations, closer alignment with the business, and teams that are empowered to outpace their adversaries.

What’s the strangest job you’ve ever had?

Digitising hard copy documents. My job was to remove staples from documentation, such as invoices, receipts, etc, and scan the documents into a computer, then shred the paper documents. Fortunately, this was just a summer job during my studies.

Another one was working in a sweet factory that made Double Lollies. I was either stood at the end of the conveyor belt boxing them as they came off, or monitoring the conveyor belt for faulty ones and picking them off, or working on the machine that stuck the lolly stick to it. Very boring, but another summer job between studies.

If you could instantly master one new skill, what would it be?

An ace skill to instantly master in SecOps would be machine learning (ML) for threat detection. As cyber threats become more sophisticated, traditional methods of detection and response are increasingly insufficient. ML enables you to analyse massive datasets, spot hidden patterns, and predict threats before they materialise.

With ML, you can build models that continuously improve based on new data, helping you identify emerging attack tactics and anomalous behaviours more effectively. The ability to apply ML techniques to threat intelligence, alert triage, and incident response would not only accelerate detection and reduce false positives but also future-proof your SecOps practices in an increasingly automated and data-driven landscape.

Mastering this skill would allow you to stay ahead of evolving threats while driving operational efficiency. It combines the power of automation with the nuanced understanding of security, making it an invaluable asset in any SecOps leader's toolkit.