Threat Detection Engineer | Threat Hunting & Purple Team

CVS Health; Sacramento (CA); On-site; USD 107,000 - 284,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

Retirement savings options

Paid time off and wellness programs

Job summary

CVS Health in the United States is seeking a Staff Threat Detection Engineer to advance our detection engineering, threat hunting, and offensive security capabilities across the security program.

You will develop detections for SIEMs, lead purple team exercises, integrate threat intelligence, and drive continuous improvement in monitoring and response.

This role requires mature security expertise and collaboration with SOC, IR, and engineering teams, with a focus on risk reduction and resilience.

Qualifications

• 7+ years of experience in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years of experience in Microsoft Security tools (Defender for Endpoint, Sentinel), CrowdStrike, and Splunk.
• 3+ years of experience with KQL, SPL, Python, PowerShell, or Bash scripting for automation and detection logic.

Responsibilities

• Develop, deploy, and optimize detection rules across SIEMs (e.g., Microsoft Sentinel, Splunk).
• Lead threat hunting activities using Defender, CrowdStrike, and other SOC tools.
• Design adversary emulation scenarios to test detection and response effectiveness.
• Produce reports with findings and actionable recommendations.
• Collaborate with blue teams in purple team exercises and share improvements.

Skills

Threat hunting

Detection engineering

Scripting (PowerShell/Python)

Security analytics

Education

Bachelor's degree

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

Job description

CVS Health in the United States is seeking a Staff Threat Detection Engineer to advance our detection engineering, threat hunting, and offensive security capabilities across the security program.

You will develop detections for SIEMs, lead purple team exercises, integrate threat intelligence, and drive continuous improvement in monitoring and response.

This role requires mature security expertise and collaboration with SOC, IR, and engineering teams, with a focus on risk reduction and resilience.