Senior Threat Detection Engineer

CVS Health; Helena (MT); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Comprehensive benefits

Bonus eligibility

Equity incentives

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to strengthen security posture through threat hunting, detection engineering, and offensive security practices. You will leverage telemetry, threat intel, and adversary emulation to uncover risks and prevent business impact.

collaboration with SOC, IR, and other teams, plus automation and purple team activities, will be key to improving detections, controls, and response capabilities across the organization.

Qualifications

• 7+ years in threat detection, hunting, testing, or offensive security.
• 5+ years with Microsoft security tools (Defender, Sentinel), CrowdStrike and Splunk.
• 3+ years scripting (KQL, SPL, Python, PowerShell or Bash) for automation.

Responsibilities

• Develop, deploy, and optimize detections across SIEM platforms.
• Conduct threat hunting with Defender, CrowdStrike and SOC tools.
• Create custom detections using KQL and SPL; automate responses.
• Assist in internal/external pen tests and adversary emulation.
• Lead purple team exercises and insights for monitoring improvements.
• Integrate threat intel into detection strategies and risk controls.
• Support incident response with adversary tactics insights.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

SIEM tuning

Automation scripting

Security tooling

Education

Bachelor's degree or equivalent

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

Job description

CVS Health is seeking a Staff Threat Detection Engineer to strengthen security posture through threat hunting, detection engineering, and offensive security practices. You will leverage telemetry, threat intel, and adversary emulation to uncover risks and prevent business impact.

collaboration with SOC, IR, and other teams, plus automation and purple team activities, will be key to improving detections, controls, and response capabilities across the organization.