Senior Threat Detection Engineer — Threat Hunting & Purple Team

CVS Health; Columbus (OH); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

Retirement savings

Paid time off

Wellness programs

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to fortify the organization's security posture. You will develop detections, hunt threats, and emulate adversaries to validate defenses across SIEMs like Microsoft Sentinel and Splunk.

You will collaborate with Security Operations and Incident Response, using KQL/SPL alongside Defender for Endpoint and CrowdStrike to mature detection and response capabilities. A strong focus on automation and tooling is expected.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience in Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash scripting for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting activities using Microsoft Defender, CrowdStrike, and other SOC tools to identify and respond to advanced threats.
• Leverage KQL and SPL to create custom detections and automate responses.
• Continuously refine detection capabilities based on emerging threats and intelligence.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Adversary emulation

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Job description

CVS Health is seeking a Staff Threat Detection Engineer to fortify the organization's security posture. You will develop detections, hunt threats, and emulate adversaries to validate defenses across SIEMs like Microsoft Sentinel and Splunk.

You will collaborate with Security Operations and Incident Response, using KQL/SPL alongside Defender for Endpoint and CrowdStrike to mature detection and response capabilities. A strong focus on automation and tooling is expected.