Lead Threat Detection Engineer & Adversary Emulation

CVS Health; Annapolis (MD); On-site; USD 107,000 - 284,000; Full time

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to lead detection engineering, threat hunting, and offensive security initiatives. You will work with Security Operations and Incident Response to build robust detections across SIEMs like Microsoft Sentinel and Splunk, and to emulate adversaries for stronger defenses.

The role emphasizes collaboration, automation, and continuous improvement of monitoring, with a focus on reducing threat impact and strengthening the security posture of CVS

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of scripting for automation and detection logic (KQL, SPL, Python, PowerShell, Bash).

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms like Microsoft Sentinel and Splunk.
• Conduct threat hunting using Defender, CrowdStrike, and SOC tools to identify advanced threats.
• Create detections with KQL/SPL and automate responses; refine detections based on threats.
• Assist with penetration tests and adversary emulation to evaluate detection effectiveness.
• Collaborate in purple team exercises and translate threat intelligence into detections.
• Support incident response and contribute to a security strategy aligned with risk management.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Education

Bachelor's degree or equivalent

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to lead detection engineering, threat hunting, and offensive security initiatives. You will work with Security Operations and Incident Response to build robust detections across SIEMs like Microsoft Sentinel and Splunk, and to emulate adversaries for stronger defenses.

The role emphasizes collaboration, automation, and continuous improvement of monitoring, with a focus on reducing threat impact and strengthening the security posture of CVS