Senior Threat Detection Engineer

CVS Health; Lansing (MI); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Bonus program

Equity awards

Comprehensive benefits

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to join our security organization in the United States. The role focuses on threat hunting, detection engineering, and adversary emulation to strengthen our security posture.

By leveraging telemetry, threat intel, and adversary-focused analysis, you will help ensure threats are identified and addressed before they impact the business. Working closely with Security Operations and Incident Response, you will develop detections, validate

Qualifications

• 7+ years in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years with Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years scripting (KQL, SPL, Python, PowerShell, or Bash) for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms like Splunk and Microsoft Sentinel.
• Conduct threat hunting using Defender, CrowdStrike, and other SOC tools to identify advanced threats.
• Execute adversary emulation scenarios and produce actionable findings.
• Collaborate in purple team exercises to validate detections and response capabilities.
• Integrate threat intel to prioritize detections and improve monitoring and incident response.
• Support incident response with adversary insights and use-case development.

Skills

Threat detection

Threat hunting

Scripting for automation

Education

Bachelor's degree or equivalent experience

Tools

Splunk

Microsoft Defender

CrowdStrike

KQL / SPL

Job description

CVS Health is seeking a Staff Threat Detection Engineer to join our security organization in the United States. The role focuses on threat hunting, detection engineering, and adversary emulation to strengthen our security posture.

By leveraging telemetry, threat intel, and adversary-focused analysis, you will help ensure threats are identified and addressed before they impact the business. Working closely with Security Operations and Incident Response, you will develop detections, validate