Threat Detection Engineer: Purple Team & Offensive Security

Koitecc Solutions; Boston (MA); Hybrid; USD 107,000 - 284,000; Full time

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to join the security team and strengthen detection capabilities. You will lead threat hunting, detection engineering, and adversary emulation activities to uncover risks before they impact the business.

You will collaborate with Security Operations, Incident Response, and purple team exercises to improve visibility, automation, and response effectiveness across SIEM platforms like Microsoft Sentinel and Splunk.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash scripting for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting activities using Microsoft Defender, CrowdStrike, and other SOC tools to identify and respond to advanced threats.
• Leverage KQL and SPL to create custom detections and automate responses.
• Assist with internal and external penetration tests to identify vulnerabilities.
• Design and execute adversary emulation scenarios to assess detection and response effectiveness.
• Produce detailed reports with findings and actionable recommendations.
• Work closely with blue teams to conduct purple team exercises, bridging offensive and defensive security efforts.
• Provide actionable insights to improve monitoring, alerting, and incident response based on adversary tactics.
• Integrate threat intelligence into detection strategies to prioritize threats and adapt detection rules.

Skills

Threat detection

Threat hunting

Penetration testing

Scripting

Education

Bachelor's degree

Tools

Microsoft Defender

Sentinel

CrowdStrike

Splunk

Job description

CVS Health is seeking a Staff Threat Detection Engineer to join the security team and strengthen detection capabilities. You will lead threat hunting, detection engineering, and adversary emulation activities to uncover risks before they impact the business.

You will collaborate with Security Operations, Incident Response, and purple team exercises to improve visibility, automation, and response effectiveness across SIEM platforms like Microsoft Sentinel and Splunk.