Staff Threat Detection Engineer: Adversary Emulation & SIEM

CVS Health; Olympia (WA); On-site; USD 120,000 - 260,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

Retirement plan

Paid time off

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to join our security organization in the United States. You will lead threat hunting, detection engineering, and adversary emulation to strengthen our security posture and reduce risk to patients, colleagues, and business operations.

You will collaborate with Security Operations, Incident Response, and blue/red teams to develop detections across SIEMs like Microsoft Sentinel and Splunk, and to implement automation using KQL/SPL and

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience in Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash scripting for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk
• Conduct threat hunting activities using Microsoft Defender, CrowdStrike, and other SOC tools to identify and respond to advanced threats.
• Leverage KQL and SPL (Search Processing Language) to create custom detections and automate responses.
• Continuously refine detection capabilities based on emerging threats and intelligence.
• Assist with internal and external penetration tests to identify vulnerabilities.
• Design and execute adversary emulation scenarios to assess detection and response effectiveness.
• Utilize penetration testing tools and custom scripts to simulate real-world attack scenarios.
• Produce detailed reports with findings and actionable recommendations.
• Work closely with blue teams to conduct purple team exercises, bridging offensive and defensive security efforts.
• Provide actionable insights to improve monitoring, alerting, and incident response based on adversary tactics.
• Facilitate knowledge-sharing sessions to upskill internal teams on TTPs.

Skills

Threat detection

Threat hunting

Offensive security

Security analytics

Communication

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Defender Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to join our security organization in the United States. You will lead threat hunting, detection engineering, and adversary emulation to strengthen our security posture and reduce risk to patients, colleagues, and business operations.

You will collaborate with Security Operations, Incident Response, and blue/red teams to develop detections across SIEMs like Microsoft Sentinel and Splunk, and to implement automation using KQL/SPL and