Senior Threat Detection Engineer — SIEM, Threat Hunting

CVS Health; Providence (RI); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Bonus eligibility

Equity awards

Comprehensive benefits

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to stay ahead of cyber threats by combining threat hunting, detection engineering, and offensive security to identify risks and strengthen the security posture. You will work with Security Operations, Incident Response, and other teams to build detections and support investigations.

The role involves validating controls through purple team exercises, adversary emulation, and automation to improve visibility, response, and overall security

Qualifications

• 7+ years in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years with Microsoft security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years scripting (Python, PowerShell, or Bash) for automation and detections.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEMs such as Microsoft Sentinel and Splunk.
• Conduct threat hunting using Defender, CrowdStrike, and SOC tools to identify advanced threats.
• Design adversary emulation scenarios and perform internal/external pen tests.
• Lead purple team exercises and share insights to improve monitoring and incident response.
• Integrate threat intelligence into detection strategies and run use cases with IR.
• Contribute to risk-based security strategy reporting.

Skills

Threat detection

Threat hunting

Offensive security

Security analytics

Python

PowerShell

Bash

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

Penetration testing tools

Job description

CVS Health is seeking a Staff Threat Detection Engineer to stay ahead of cyber threats by combining threat hunting, detection engineering, and offensive security to identify risks and strengthen the security posture. You will work with Security Operations, Incident Response, and other teams to build detections and support investigations.

The role involves validating controls through purple team exercises, adversary emulation, and automation to improve visibility, response, and overall security