Senior Threat Detection & Hunting Engineer

CVS Health; Oklahoma City (OK); On-site; USD 107,000 - 284,000; Full time

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to help stay ahead of evolving cyber threats. You will combine threat hunting, detection engineering, and offensive security to identify risks and strengthen security posture across the organization.

Working with Security Operations and Incident Response, you will develop detections, support investigations, and lead adversary emulation, purple team exercises, and automation initiatives to improve visibility and response.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash scripting for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting activities using Defender, CrowdStrike, and other SOC tools to identify advanced threats.
• Leverage KQL and SPL to create detections and automate responses.
• Refine detection capabilities based on emerging threats and intelligence.
• Assist with internal and external penetration tests to identify vulnerabilities.
• Design adversary emulation scenarios to assess detection and response effectiveness.
• Produce detailed reports with findings and actionable recommendations.
• Work with blue teams to conduct purple team exercises and improve monitoring and incident response.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Automation scripting

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to help stay ahead of evolving cyber threats. You will combine threat hunting, detection engineering, and offensive security to identify risks and strengthen security posture across the organization.

Working with Security Operations and Incident Response, you will develop detections, support investigations, and lead adversary emulation, purple team exercises, and automation initiatives to improve visibility and response.