Senior Threat Detection Engineer — Purple Team & Hunting

Koitecc Solutions; Dover (DE); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Comprehensive benefits package

Bonus eligible

Equity award program

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to advance threat hunting, detection engineering, and offensive security. You will leverage telemetry, threat intel, and adversary emulation to strengthen security posture across the organization.

In collaboration with Security Operations and Incident Response, you will build detections for SIEM platforms like Microsoft Sentinel and Splunk, while enabling automated responses and purple team exercises to validate security controls.

Qualifications

• 7+ years in threat detection, hunting, penetration testing, or offensive security.
• 5+ years with Microsoft Defender, Sentinel, CrowdStrike, and Splunk.
• 3+ years scripting (Python, PowerShell, Bash) for automation and detections.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEMs such as Microsoft Sentinel and Splunk.
• Conduct threat hunting with Defender, CrowdStrike, and other SOC tools.
• Create detections with KQL/SPL and automate responses.
• Perform adversary emulation and purple team exercises to validate controls.
• Produce detailed reports with findings and actionable recommendations.
• Collaborate with IR and security teams to improve monitoring and response.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Automation scripting

Education

Bachelor's degree or equivalent

Tools

Microsoft Defender

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Job description

CVS Health is seeking a Staff Threat Detection Engineer to advance threat hunting, detection engineering, and offensive security. You will leverage telemetry, threat intel, and adversary emulation to strengthen security posture across the organization.

In collaboration with Security Operations and Incident Response, you will build detections for SIEM platforms like Microsoft Sentinel and Splunk, while enabling automated responses and purple team exercises to validate security controls.