Threat Detection Engineer - Threat Hunting & Purple Team

CVS Health; Madison (WI); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Bonus eligibility

Equity awards

Comprehensive benefits

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to advance threat hunting, detection engineering and adversary emulation. You will build detections across SIEMs like Microsoft Sentinel and Splunk, and work with defenders to strengthen security controls.

Responsibilities include validating detections with purple team exercises, leveraging Defender for Endpoint and CrowdStrike, and crafting actionable reports.

Qualifications

• 7+ years in threat detection, hunting, penetration testing or offensive security.
• 5+ years with Microsoft security tools (Defender for Endpoint, Sentinel), CrowdStrike and Splunk.
• 3+ years scripting (KQL, SPL, Python, PowerShell, Bash) for automation.

Responsibilities

• Develop, tune and optimize detections across SIEM platforms.
• Conduct threat hunting and adversary emulation to improve detection.
• Collaborate with blue/purple teams and incident response for improved detections.
• Integrate threat intelligence into detection strategies and risk improvements.

Education

Bachelor's degree or equivalent

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

KQL

SPL

Python

PowerShell

Bash

Job description

CVS Health is seeking a Staff Threat Detection Engineer to advance threat hunting, detection engineering and adversary emulation. You will build detections across SIEMs like Microsoft Sentinel and Splunk, and work with defenders to strengthen security controls.

Responsibilities include validating detections with purple team exercises, leveraging Defender for Endpoint and CrowdStrike, and crafting actionable reports.