Senior Threat Detection & Purple Team Engineer

CVS Health; Pierre (SD); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Bonus potential

Equity awards

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to join its cybersecurity team in the United States. You will lead threat hunting, detection engineering, and offensive security initiatives to identify and mitigate evolving cyber threats across the enterprise.

You will integrate with Security Operations, Incident Response, and purple-team activities to strengthen defenses, deploy detections, and automate responses using SIEMs like Microsoft Sentinel and Splunk.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft Defender, Defender for Endpoint, Sentinel, CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash scripting for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms.
• Conduct threat hunting to identify and respond to advanced threats.
• Assist with internal and external penetration tests to identify vulnerabilities.
• Design and execute adversary emulation scenarios to assess detection and response.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

KQL

SPL

Python

PowerShell

Bash scripting

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

Job description

CVS Health is seeking a Staff Threat Detection Engineer to join its cybersecurity team in the United States. You will lead threat hunting, detection engineering, and offensive security initiatives to identify and mitigate evolving cyber threats across the enterprise.

You will integrate with Security Operations, Incident Response, and purple-team activities to strengthen defenses, deploy detections, and automate responses using SIEMs like Microsoft Sentinel and Splunk.