Senior Threat Detection Engineer & Threat Hunter

CVS Health; Springfield (IL); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Bonus potential

Equity awards

Comprehensive benefits

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to join our security team in the United States. The role combines threat hunting, detection engineering, and offensive security to identify and mitigate evolving threats across the organization.

You will work with Security Operations, Incident Response, and other cybersecurity groups to develop detections, support investigations, and validate controls through purple team exercises and adversary emulation activities.

Qualifications

• 7+ years in threat detection, hunting, or offensive security.
• 5+ years with Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years scripting for automation (Python/PowerShell/Bash).

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms like Microsoft Sentinel and Splunk.
• Conduct threat hunting with Defender, CrowdStrike, and other SOC tools.
• Create custom detections using KQL/SPL and automate responses.
• Assist with penetration testing and adversary emulation scenarios.
• Participate in purple team exercises to improve monitoring and response.

Skills

Threat detection

Threat hunting

Penetration testing

Adversary emulation

Purple team

Scripting

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to join our security team in the United States. The role combines threat hunting, detection engineering, and offensive security to identify and mitigate evolving threats across the organization.

You will work with Security Operations, Incident Response, and other cybersecurity groups to develop detections, support investigations, and validate controls through purple team exercises and adversary emulation activities.