Senior Threat Detection Engineer & Purple Team Lead

CVS Health; Honolulu (HI); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Comprehensive benefits

Bonus eligibility

Career development

Job summary

CVS Health is hiring a Staff Threat Detection Engineer to join a security-first team focused on threat hunting, detection engineering, and adversary emulation. You will lead detection rule development across SIEM platforms, support investigations, and drive improvements with purple-team exercises.

The role requires deep experience in threat detection and hands-on work with Defender, Sentinel, CrowdStrike, and Splunk, plus scripting for automation.

Qualifications

• 7+ years in threat detection, hunting, or offensive security.
• 5+ years with Microsoft Defender for Endpoint, Sentinel, and related tools.
• 3+ years Python, PowerShell, or Bash for automation and detection logic.

Responsibilities

• Detection Engineering & Threat Hunting: build and optimize SIEM detections.
• Penetration Testing & Adversary Emulation: run internal/external tests and emulations.
• Purple Team Operations: coordinate with blue teams to improve alerting.
• Threat Intelligence Integration: convert intel into detections and actions.
• Incident Response Support: assist investigations with adversary insights.
• Security Strategy & Risk Management: report gaps and detection effectiveness.

Skills

Threat detection

Threat hunting

Offensive security

Penetration testing

Scripting

Security tooling

Education

Bachelor's degree

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

Job description

CVS Health is hiring a Staff Threat Detection Engineer to join a security-first team focused on threat hunting, detection engineering, and adversary emulation. You will lead detection rule development across SIEM platforms, support investigations, and drive improvements with purple-team exercises.

The role requires deep experience in threat detection and hands-on work with Defender, Sentinel, CrowdStrike, and Splunk, plus scripting for automation.