Senior Threat Detection & Hunting Engineer

CVS Health; Saint Paul (MN); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Bonus eligibility

Equity awards

Comprehensive benefits

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to join the security organization. This role combines threat hunting, detection engineering and offensive security to identify suspicious activity, strengthen security posture, and help ensure threats are addressed before they impact the business.

You will work with Security Operations, Incident Response and other teams to develop detections, validate controls, and support purple team exercises.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of scripting for automation and detection logic (KQL, SPL, Python, PowerShell, or Bash).

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk
• Conduct threat hunting activities using Microsoft Defender, CrowdStrike, and other SOC tools
• Leverage KQL and SPL to create custom detections and automate responses
• Continuously refine detection capabilities based on emerging threats and intelligence
• Assist with internal and external penetration tests to identify vulnerabilities
• Design and execute adversary emulation scenarios to assess detection and response effectiveness
• Utilize penetration testing tools and custom scripts to simulate real-world attack scenarios
• Produce detailed reports with findings and actionable recommendations

Skills

Threat detection

Threat hunting

Automation scripting

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

Job description

CVS Health is seeking a Staff Threat Detection Engineer to join the security organization. This role combines threat hunting, detection engineering and offensive security to identify suspicious activity, strengthen security posture, and help ensure threats are addressed before they impact the business.

You will work with Security Operations, Incident Response and other teams to develop detections, validate controls, and support purple team exercises.