Threat Detection Engineer — Purple Team Lead

CVS Health; Juneau (AK); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Bonus eligibility

Comprehensive benefits

Equity awards

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to advance detection engineering, threat hunting, and offensive security capabilities. You will work with Security Operations and Incident Response to strengthen detection and response across modern SIEM platforms.

The role emphasizes adversary emulation, threat intel integration, and ongoing improvements to detection coverage, with collaboration across teams and strong analytical skills.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience in Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash scripting for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting activities using Microsoft Defender, CrowdStrike, and other SOC tools to identify and respond to advanced threats.
• Leverage KQL and SPL to create custom detections and automate responses.
• Continuously refine detection capabilities based on emerging threats and intelligence.
• Assist with internal and external penetration tests to identify vulnerabilities.
• Design and execute adversary emulation scenarios to assess detection and response effectiveness.
• Produce detailed reports with findings and actionable recommendations.
• Work closely with blue teams to conduct purple team exercises, bridging offensive and defensive security efforts.
• Provide actionable insights to improve monitoring, alerting, and incident response based on adversary tactics.
• Integrate threat intelligence into detection strategies to prioritize threats and adapt rules.
• Collaborate with the incident response team during investigations by providing adversary tactics insights.
• Contribute to the development of a comprehensive detection strategy aligned with risk management goals.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Microsoft Defender

Sentinel

CrowdStrike

Splunk

KQL

SPL

Education

Bachelor's degree

Tools

Microsoft Defender

Sentinel

CrowdStrike

Splunk

KQL

SPL

Job description

CVS Health is seeking a Staff Threat Detection Engineer to advance detection engineering, threat hunting, and offensive security capabilities. You will work with Security Operations and Incident Response to strengthen detection and response across modern SIEM platforms.

The role emphasizes adversary emulation, threat intel integration, and ongoing improvements to detection coverage, with collaboration across teams and strong analytical skills.