Senior Threat Detection Engineer – Purple Team

CVS Health; Richmond (VA); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Bonus program

Equity awards

Comprehensive benefits

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to advance our detection and response capabilities. You will build detections across SIEMs, hunt for advanced threats, and run adversary emulation exercises to test and improve our security controls.

The role partners with Security Operations, Incident Response, and other cybersecurity teams, contributing to the risk‑based detection strategy and ongoing automation efforts.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years with Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of automation scripting in Python/PowerShell/Bash for detections.

Responsibilities

• Develop, deploy, and optimize detections across SIEM platforms (Microsoft Sentinel, Splunk).
• Conduct threat hunting using Defender for Endpoint and CrowdStrike to identify advanced threats.
• Design adversary emulation scenarios and perform purple team exercises.
• Produce reports with findings and actionable remediation guidance.
• Integrate threat intelligence into detection strategies and support incident response.

Skills

Threat detection

Threat hunting

Penetration testing

Adversary emulation

KQL

SPL

Python

PowerShell

Automation

Education

Bachelor’s degree or equivalent

Tools

Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

Job description

CVS Health is seeking a Staff Threat Detection Engineer to advance our detection and response capabilities. You will build detections across SIEMs, hunt for advanced threats, and run adversary emulation exercises to test and improve our security controls.

The role partners with Security Operations, Incident Response, and other cybersecurity teams, contributing to the risk‑based detection strategy and ongoing automation efforts.