Threat Detection Engineer - Purple Team & Threat Hunting

CVS Health; Denver (CO); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Bonus eligibility

Equity award program

Comprehensive benefits

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to advance threat detection, hunting, and offensive security practices. Work with Security Operations, Incident Response, and purple team activities to strengthen defenses and improve tooling and automation.

Strong collaboration across teams will be essential to translate intelligence into actionable detections and responses. You will lead detection engineering efforts, develop adversary emulation scenarios, and contribute to risk-informed

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft Defender for Endpoint, Sentinel, CrowdStrike, and Splunk.
• 3+ years of scripting (Python, PowerShell, or Bash) for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting activities using Defender, CrowdStrike, and other SOC tools to identify advanced threats.
• Leverage KQL and SPL to create custom detections and automate responses.
• Produce detailed reports with findings and actionable recommendations.

Skills

Threat detection

Threat hunting

Offensive security

Incident response

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Sentinel

CrowdStrike

Splunk

Job description

CVS Health is seeking a Staff Threat Detection Engineer to advance threat detection, hunting, and offensive security practices. Work with Security Operations, Incident Response, and purple team activities to strengthen defenses and improve tooling and automation.

Strong collaboration across teams will be essential to translate intelligence into actionable detections and responses. You will lead detection engineering efforts, develop adversary emulation scenarios, and contribute to risk-informed