Senior Threat Detection Engineer | Threat Hunting & SIEM

Koitecc Solutions; Atlanta (GA); Hybrid; USD 107,000 - 284,000; Full time

Benefits offered by this job

Medical, dental, vision

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to bolster threat hunting, detection engineering, and offensive security capabilities. You will utilize telemetry, threat intel, and adversary-focused analysis to identify risks and strengthen security posture.

You will collaborate with Security Operations, Incident Response, and other cybersecurity teams to develop detections, validate controls, and support investigations through purple team exercises and adversary emulation.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of experience with scripting for automation and detection logic (Python, PowerShell, or Bash).

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms (Microsoft Sentinel, Splunk).
• Conduct threat hunting to identify advanced threats using Defender, CrowdStrike, and other SOC tools.
• Design and execute adversary emulation scenarios to test detections and response effectiveness.
• Produce detailed reports with findings and actionable recommendations.
• Collaborate with blue teams in purple team exercises to improve monitoring and incident response.
• Integrate threat intelligence into detection strategies and prioritize threats.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Security analytics

Incident response

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to bolster threat hunting, detection engineering, and offensive security capabilities. You will utilize telemetry, threat intel, and adversary-focused analysis to identify risks and strengthen security posture.

You will collaborate with Security Operations, Incident Response, and other cybersecurity teams to develop detections, validate controls, and support investigations through purple team exercises and adversary emulation.