Senior Security Engineer

CVS Health is a healthcare company focused on creating a more connected, convenient, and compassionate health experience. The Senior Security Engineer will proactively conduct threat hunts, analyze security data, support incident response investigations, and strengthen the organization’s detection engineering and overall cyber defense posture.

Responsibilities:

• Conduct hypothesis-driven threat hunts across endpoint, network, identity, and cloud telemetry using frameworks like MITRE ATT&CK
• Analyze large volumes of log and event data (SIEM, EDR, NetFlow, DNS, cloud audit logs) to identify anomalous or malicious activity
• Document hunt methodology, findings, and outcomes in a structured, repeatable format
• Support incident response investigations with deep-dive analysis when hunts surface confirmed threats
• Stay current on emerging TTPs, malware families, and threat actor campaigns relevant to the organization's industry and threat landscape

Requirements:

• 5+ years of experience in threat hunting, detection engineering, incident response, or SOC analysis
• Strong understanding of attacker TTPs and the MITRE ATT&CK framework
• Hands-on experience with SIEM platforms (e.g., Chronicle/GCP SecOps, Splunk) and EDR tools (e.g., CrowdStrike)
• Proficiency in query languages (KQL, SPL, YARA-L, or similar) and scripting (Python preferred) for data analysis and automation
• Solid understanding of networking, operating systems (Windows/Linux), and cloud environments (AWS, GCP, or Azure)
• Bachelor's degree from accredited university or equivalent work experience (High School Diploma/GED + 4 years relevant experience)
• Experience in a regulated industry (healthcare, financial services, insurance) with familiarity in compliance frameworks (NIST 800-53, FTC Safeguards Rule)
• Familiarity with data engineering/analytics pipelines (Databricks, NiFi) used to support hunt data access
• Relevant certifications (GCFA, GNFA, GCTI, OSCP, or similar)
• Experience contributing to or building detection content/rules