Threat Detection Engineer — Threat Hunting & Purple Team

CVS Health; Nashville (TN); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Bonus program

Comprehensive benefits

Equity award target

Job summary

CVS Health is seeking a Staff Threat Detection Engineer to lead threat hunting, detection engineering, and adversary emulation to strengthen security posture. You will leverage telemetry, threat intel, and automated tooling to identify, investigate, and mitigate emerging risks across the organization.

The role collaborates with Security Operations, Incident Response, and other cybersecurity teams, driving purple team exercises and integration of new tools to improve visibility and response

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience in Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of scripting (KQL, SPL, Python, PowerShell, or Bash) for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting activities using Defender, CrowdStrike, and other SOC tools to identify and respond to advanced threats.
• Design and execute adversary emulation scenarios to assess detection and response effectiveness.
• Assist with internal and external penetration tests to identify vulnerabilities.
• Produce detailed reports with findings and actionable recommendations.
• Work with blue teams on purple team exercises to improve monitoring and incident response.

Skills

Threat detection

Threat hunting

Penetration testing

Offensive security

Automation scripting

Education

Bachelor's degree

Tools

Microsoft Defender for Endpoint

Azure Sentinel

CrowdStrike

Splunk

Job description

CVS Health is seeking a Staff Threat Detection Engineer to lead threat hunting, detection engineering, and adversary emulation to strengthen security posture. You will leverage telemetry, threat intel, and automated tooling to identify, investigate, and mitigate emerging risks across the organization.

The role collaborates with Security Operations, Incident Response, and other cybersecurity teams, driving purple team exercises and integration of new tools to improve visibility and response