Threat Detection Engineer — Remote, Purple Team

CVS Health Corporation; Northern, New York (KY, NY); Hybrid; USD 107,000 - 284,000; Full time

Benefits offered by this job

Comprehensive benefits

Retirement options

Wellness programs

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to advance our threat detection program. You will develop detections across SIEMs, perform threat hunting, and engage in adversary emulation to improve detection and response.

You will collaborate with security teams, contribute to purple team exercises, and continually integrate threat intel into detection strategies. The role supports hybrid remote work in the U.S., with opportunities to influence security posture at a national scale.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience with Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of scripting for automation and detection logic (KQL, SPL, Python, PowerShell, or Bash).

Responsibilities

• Develop, tune, and deploy detection rules across SIEM platforms.
• Conduct threat hunting to identify and respond to advanced threats.
• Assist with purple team exercises and adversary emulation.
• Integrate threat intelligence into detection strategies.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

MITRE ATT&CK

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to advance our threat detection program. You will develop detections across SIEMs, perform threat hunting, and engage in adversary emulation to improve detection and response.

You will collaborate with security teams, contribute to purple team exercises, and continually integrate threat intel into detection strategies. The role supports hybrid remote work in the U.S., with opportunities to influence security posture at a national scale.