Threat Detection Lead: SIEM, Purple Team & Emulation

Koitecc Solutions; Springfield (IL); On-site; USD 107,000 - 284,000; Full time

Job summary

CVS Health in Illinois is seeking a Staff Threat Detection Engineer to help the organization stay ahead of evolving cyber threats. You will combine threat hunting, detection engineering, and adversary emulation to identify suspicious activity and strengthen security posture.

You will work with Security Operations, Incident Response, and other teams to develop detections, support investigations, and validate controls through purple team exercises.

Qualifications

• 7+ years in threat detection, hunting, penetration testing, and/or offensive security.
• 5+ years using Microsoft Defender for Endpoint, Defender for Endpoint, Sentinel, CrowdStrike, and Splunk.
• 3+ years scripting in Python, PowerShell, or Bash for automation and detection logic.

Responsibilities

• Develop, tune, and deploy detection rules across SIEM platforms such as Microsoft Sentinel and Splunk.
• Conduct threat hunting activities using Microsoft Defender, CrowdStrike, and other SOC tools to identify and respond to advanced threats.
• Leverage KQL and SPL to create custom detections and automate responses, refining capabilities with evolving threats.
• Assist with internal and external penetration tests to identify vulnerabilities and design adversary emulation scenarios.
• Produce detailed reports with findings and actionable recommendations.
• Work with blue teams to conduct purple team exercises and improve monitoring, alerting, and IR.

Skills

Threat detection

Threat hunting

Automation scripting

Penetration testing

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

CrowdStrike

Splunk

Job description

CVS Health in Illinois is seeking a Staff Threat Detection Engineer to help the organization stay ahead of evolving cyber threats. You will combine threat hunting, detection engineering, and adversary emulation to identify suspicious activity and strengthen security posture.

You will work with Security Operations, Incident Response, and other teams to develop detections, support investigations, and validate controls through purple team exercises.