Senior Threat Detection Engineer - Threat Hunting

Idaho Society of Professional Engineers; Boise, Northern (ID, KY); Hybrid; USD 107,000 - 284,000; Full time

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to advance detection engineering, threat hunting and offensive security capabilities. This role collaborates with Security Operations and Incident Response to identify threats and strengthen defenses across the organization.

You will develop detections on SIEMs like Microsoft Sentinel and Splunk, perform adversary emulation, and contribute to purple team exercises, threat intel integration, and incident response support.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of scripting in KQL, SPL, Python, PowerShell, or Bash for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms (Microsoft Sentinel, Splunk).
• Conduct threat hunting using Defender, CrowdStrike, and other SOC tools to identify advanced threats.
• Create detections with KQL/SPL and automate responses; refine detection capabilities with new intel.
• Assist with internal/external penetration tests and adversary emulation scenarios.
• Produce detailed reports with findings and actionable recommendations.
• Collaborate with blue teams in purple team exercises to improve monitoring and response.
• Integrate threat intelligence to prioritize threats and adapt detection rules.
• Support incident response investigations with adversary tactics insights.

Skills

Threat hunting

Penetration testing

Offensive security

Automation scripting

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender

Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to advance detection engineering, threat hunting and offensive security capabilities. This role collaborates with Security Operations and Incident Response to identify threats and strengthen defenses across the organization.

You will develop detections on SIEMs like Microsoft Sentinel and Splunk, perform adversary emulation, and contribute to purple team exercises, threat intel integration, and incident response support.