Senior Threat Hunting & Detection Engineer

CVS Health; Little Rock (AR); On-site; USD 107,000 - 284,000; Full time

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to lead detection engineering, threat hunting, and offensive security initiatives. You will work with Security Operations and Incident Response to identify threats, develop detections, and validate controls through adversary emulation and purple team exercises.

Strong scripting and SIEM experience are required. The role emphasizes collaboration across cybersecurity teams, ongoing tool adoption, and improving visibility and response.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash scripting for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms (Microsoft Sentinel, Splunk).
• Conduct threat hunting using Defender, CrowdStrike, and SOC tools to identify advanced threats.
• Design and run adversary emulation scenarios to test detection and response capabilities.
• Perform purple team exercises to improve monitoring, alerting, and IR processes.
• Integrate threat intelligence into detection strategies and translate into actions.
• Support incident response with adversary tactics insights and use-case development.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Scripting (Python, PowerShell, Bash)

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

Job description

CVS Health is seeking a Staff Threat Detection Engineer to lead detection engineering, threat hunting, and offensive security initiatives. You will work with Security Operations and Incident Response to identify threats, develop detections, and validate controls through adversary emulation and purple team exercises.

Strong scripting and SIEM experience are required. The role emphasizes collaboration across cybersecurity teams, ongoing tool adoption, and improving visibility and response.