Senior Threat Detection Engineer

CVS Health; Boston (MA); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

Paid time off

Retirement savings options

Wellness programs

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to join our cybersecurity team in Boston. The role combines threat hunting, detection engineering, and offensive security to identify suspicious activity and strengthen our security posture.

You will work with Security Operations and Incident Response teams to develop detections and validate controls through adversary emulation and purple team exercises.

Qualifications

• 7+ years in threat detection, hunting, penetration testing, and/or offensive security.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting activities using Defender for Endpoint, CrowdStrike, and other SOC tools to identify and respond to advanced threats.
• Leverage KQL and SPL to create custom detections and automate responses.
• Continuously refine detection capabilities based on emerging threats and intelligence.
• Assist with internal and external penetration tests to identify vulnerabilities.
• Design and execute adversary emulation scenarios to assess detection and response effectiveness.
• Produce detailed reports with findings and actionable recommendations.
• Work with blue teams in purple team exercises to improve monitoring and incident response.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Automation & scripting

Education

Bachelor's degree or equivalent

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to join our cybersecurity team in Boston. The role combines threat hunting, detection engineering, and offensive security to identify suspicious activity and strengthen our security posture.

You will work with Security Operations and Incident Response teams to develop detections and validate controls through adversary emulation and purple team exercises.