Senior Adversary Ops Engineer - Threat Emulation & Defense

CVS Health; Lansing (MI); On-site; USD 83,000 - 222,000; Full time

Job summary

CVS Health is seeking a Senior Adversary Operations Engineer in the United States to strengthen security posture through advanced penetration testing and adversary simulations. You will lead end‑to‑end engagements from scoping to remediation, delivering actionable insights for risk‑based decisions.

The role emphasizes collaboration with SOC, incident response, and detection engineering to enhance telemetry, alerting, and response workflows, while aligning testing with evolving attacker

Qualifications

• 5+ years of hands-on experience in penetration testing, red teaming, or offensive security.
• 3+ years of experience in Kali Linux, Metasploit, Nmap, Burp Suite, and/or other related tools.
• 3+ years of experience in scripting languages (Python, PowerShell, Bash, etc).
• 3+ years of experience with cloud security (AWS, Azure, GCP) and container security.

Responsibilities

• Conduct internal and external penetration tests to identify and exploit vulnerabilities.
• Develop and execute adversary emulation scenarios to assess detection and response capabilities.
• Utilize a comprehensive suite of testing tools and create actionable reports for remediation.
• Collaborate with blue teams to design purple team exercises and improve monitoring.
• Automate penetration testing tasks using scripting to increase efficiency.
• Support incident response with adversary insights and refine threat-hunting use cases.

Skills

Penetration testing

Red teaming

Threat modeling

Strong communication skills

Education

Bachelor’s degree or equivalent experience

Tools

Kali Linux

Metasploit

Nmap

Burp Suite

Scripting languages (Python, PowerShell, Bash)

Job description

CVS Health is seeking a Senior Adversary Operations Engineer in the United States to strengthen security posture through advanced penetration testing and adversary simulations. You will lead end‑to‑end engagements from scoping to remediation, delivering actionable insights for risk‑based decisions.

The role emphasizes collaboration with SOC, incident response, and detection engineering to enhance telemetry, alerting, and response workflows, while aligning testing with evolving attacker