Senior Threat Detection & Purple Team Engineer

CVS Health; Frankfort (KY); On-site; USD 107,000 - 284,000; Full time

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to stay ahead of evolving cyber threats. You will join a team focused on threat hunting, detection engineering, and adversary emulation to strengthen security across the enterprise.

You will develop detections in SIEM platforms like Microsoft Sentinel and Splunk, perform threat hunting with Defender for Endpoint and CrowdStrike, and use KQL/SPL and Python to automate responses and improve visibility.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of scripting in Python, PowerShell, or Bash, with KQL or SPL for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting activities using Defender for Endpoint, CrowdStrike, and other SOC tools to identify advanced threats.
• Design and execute adversary emulation scenarios to assess detection and response effectiveness.
• Utilize penetration testing tools and custom scripts to simulate real-world attack scenarios.
• Produce detailed reports with findings and actionable recommendations.
• Work closely with blue teams to conduct purple team exercises, bridging offensive and defensive security efforts.
• Integrate threat intelligence into detection strategies to prioritize threats and adapt detection rules.
• Collaborate with the incident response team during investigations by providing adversary tactics insights.
• Contribute to the development of a comprehensive detection strategy aligned with risk management goals.

Skills

Threat detection

Threat hunting

Offensive security

Security automation

Education

Bachelor's degree or equivalent experience

Tools

Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to stay ahead of evolving cyber threats. You will join a team focused on threat hunting, detection engineering, and adversary emulation to strengthen security across the enterprise.

You will develop detections in SIEM platforms like Microsoft Sentinel and Splunk, perform threat hunting with Defender for Endpoint and CrowdStrike, and use KQL/SPL and Python to automate responses and improve visibility.