Threat Detection Architect: Purple Team & Automation

CVS Health; Dover (DE); On-site; USD 107,000 - 284,000; Full time

Job summary

CVS Health seeks a Staff Threat Detection Engineer to advance threat hunting, detections, and offensive security capabilities.You will develop detections across SIEMs, perform adversary emulation, and collaborate with incident response and blue teams to strengthen security controls.

Responsibilities include building automation, validating detections, and producing actionable reports while leveraging Defender, Sentinel, CrowdStrike, and Splunk.

Qualifications

• 7+ years in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash for automation/detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting using Defender, CrowdStrike, and other SOC tools to identify advanced threats.
• Leverage KQL and SPL to create custom detections and automate responses.
• Continuously refine detection capabilities based on emerging threats and intelligence.
• Assist with internal and external penetration tests to identify vulnerabilities.
• Design and execute adversary emulation scenarios to assess detection and response effectiveness.
• Produce detailed reports with findings and actionable recommendations.
• Work with blue teams to conduct purple team exercises and improve monitoring and incident response.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

KQL

SPL

Python

PowerShell

Adversary emulation

Education

Bachelor's degree or equivalent

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

Job description

CVS Health seeks a Staff Threat Detection Engineer to advance threat hunting, detections, and offensive security capabilities.You will develop detections across SIEMs, perform adversary emulation, and collaborate with incident response and blue teams to strengthen security controls.

Responsibilities include building automation, validating detections, and producing actionable reports while leveraging Defender, Sentinel, CrowdStrike, and Splunk.