Senior Threat Detection & Hunting Engineer

CVS Health; Phoenix (AZ); On-site; USD 107,000 - 284,000; Full time

Job summary

CVS Health is seeking a Staff Threat Detection Engineer in Phoenix, AZ to lead threat hunting, detection engineering, and offensive security initiatives. You will work with security operations and incident response to develop detections, emulate adversaries, and validate controls, driving improvements across tools like Defender, Sentinel, CrowdStrike, and Splunk.

You will analyze threats, build automated detections, and contribute to purple team exercises while mentoring teams on TTPs and

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience in Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash scripting for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting activities using Microsoft Defender, CrowdStrike, and other SOC tools to identify and respond to advanced threats.
• Leverage KQL and SPL to create custom detections and automate responses.
• Continuously refine detection capabilities based on emerging threats and intelligence.
• Assist with internal and external penetration tests to identify vulnerabilities.
• Design and execute adversary emulation scenarios to assess detection and response effectiveness.
• Utilize penetration testing tools and custom scripts to simulate real-world attack scenarios.
• Produce detailed reports with findings and actionable recommendations.

Skills

Threat detection

Penetration testing

Automation scripting

MITRE ATT&CK knowledge

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer in Phoenix, AZ to lead threat hunting, detection engineering, and offensive security initiatives. You will work with security operations and incident response to develop detections, emulate adversaries, and validate controls, driving improvements across tools like Defender, Sentinel, CrowdStrike, and Splunk.

You will analyze threats, build automated detections, and contribute to purple team exercises while mentoring teams on TTPs and