Senior Threat Detection Engineer & Purple Team Lead

Koitecc Solutions; Richmond (VA); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

Paid time off

Retirement savings options

Wellness programs

Equity award program

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to advance detection engineering, threat hunting, and adversary emulation. You will work with Security Operations and Incident Response to strengthen the security posture by developing detections, validating controls, and improving visibility with automation.

The role requires deep experience with MITRE ATT&CK, security tools, and collaboration across teams to drive proactive defense and risk-informed decisions.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft Defender for Endpoint, Sentinel, CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash scripting for automation.

Responsibilities

• Detection engineering and threat hunting across SIEM platforms and SOC tools.
• Assist with penetration tests and adversary emulation to validate detections.
• Lead purple team activities bridging offensive and defensive security.
• Incorporate threat intel into detection strategies and response plans.
• Support incident response and contribute to risk-based security strategy.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

KQL/SPL scripting

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

Job description

CVS Health is seeking a Staff Threat Detection Engineer to advance detection engineering, threat hunting, and adversary emulation. You will work with Security Operations and Incident Response to strengthen the security posture by developing detections, validating controls, and improving visibility with automation.

The role requires deep experience with MITRE ATT&CK, security tools, and collaboration across teams to drive proactive defense and risk-informed decisions.