Threat Detection Engineer: Purple Team & Hunting

CVS Health; Tallahassee (FL); On-site; USD 107,000 - 284,000; Full time

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to help stay ahead of evolving cyber threats. You will drive detection engineering, threat hunting, and adversary emulation to strengthen security posture and reduce business risk.

The role collaborates with Security Operations and Incident Response teams, develops new detection capabilities, and leverages tools like Microsoft Defender, Sentinel, CrowdStrike, and Splunk to deliver measurable improvements in alert accuracy and response speed.

Qualifications

• 7+ years of experience in threat detection, hunting, and offensive security.
• 5+ years of experience with Microsoft security tools (Defender, Sentinel).
• 3+ years of scripting in Python/PowerShell/Bash for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms (Microsoft Sentinel, Splunk).
• Conduct threat hunting with Defender, CrowdStrike, and other SOC tools.
• Create detections with KQL and SPL and automate responses.
• Lead purple team exercises and adversary emulation to test detections.
• Provide actionable insights to improve monitoring and incident response.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Automation scripting

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Defender Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to help stay ahead of evolving cyber threats. You will drive detection engineering, threat hunting, and adversary emulation to strengthen security posture and reduce business risk.

The role collaborates with Security Operations and Incident Response teams, develops new detection capabilities, and leverages tools like Microsoft Defender, Sentinel, CrowdStrike, and Splunk to deliver measurable improvements in alert accuracy and response speed.