Senior Threat Detection Engineer & Adversary Emulation

CVS Health; Salem (OR); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

Bonus and equity awards

Comprehensive benefits

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to strengthen our security posture through threat hunting, detection engineering, and adversary emulation. You will work with Security Operations and Incident Response to develop detections across SIEMs, perform purple team exercises, and drive automation and tool integration.

The role requires 7+ years in threat detection or offensive security, 5+ years with Microsoft Defender/Sentinel, CrowdStrike, and Splunk, and 3+ years scripting (KQL,

Qualifications

• 7+ years in threat detection, hunting or offensive security.
• 5+ years with Microsoft security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years scripting (KQL, SPL, Python, PowerShell, or Bash) for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detections across SIEMs like Microsoft Sentinel and Splunk.
• Conduct threat hunting using Defender, CrowdStrike, and SOC tools.
• Create custom detections with KQL and SPL and automate responses.
• Perform adversary emulation and purple team exercises.
• Collaborate with blue teams to improve monitoring and incident response.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Automation scripting

Education

Bachelor's degree or equivalent

Tools

Microsoft Defender

Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to strengthen our security posture through threat hunting, detection engineering, and adversary emulation. You will work with Security Operations and Incident Response to develop detections across SIEMs, perform purple team exercises, and drive automation and tool integration.

The role requires 7+ years in threat detection or offensive security, 5+ years with Microsoft Defender/Sentinel, CrowdStrike, and Splunk, and 3+ years scripting (KQL,